They are already looking for your GraphQL
Ninety-one requests in one week went hunting for a GraphQL endpoint on an address that hosts nothing, spread across nineteen distinct paths. The plain endpoint, the versioned variants, and then the developer tools - a console, an explorer, a playground, a schema browser - none of which belong on a public address. Several combine the hunt with a repository directory, betting both mistakes were made together. It matters this week because a critical unauthenticated flaw in a widely self-hosted platform was published days ago, in exactly that layer.
Ninety-one requests this week looked for a GraphQL endpoint on a server that does not have one.
GraphQL is one endpoint that answers any question you know how to ask. That is the appeal, and also why it is worth finding.
Sorted by path, the search is methodical. The obvious one first, then the versioned variants, because interfaces move between releases.
Then the developer tools. A console. An explorer. A playground. Each exists so a developer can interrogate the schema by hand, and none belongs on a public address.
Nineteen distinct paths. Several put a repository directory in front, betting whoever exposed one mistake exposed the other too.
Worth knowing this week, because a critical flaw needing no account was published days ago in exactly that layer.
Turn off introspection, and never ship the console.
#linux#security#selfhosted#infosec#webdev
❯ Turn off introspection and never ship the console.