GraphQL Deep Dive

GraphQL vulnerabilities are high-value because the attack surface is both broad and deep — a single endpoint can expose entire data models, privilege escalation paths, and cross-API state confusion. Highest payouts occur in:

• Platform APIs (GitHub, Shopify, Stripe-tier targets) where GraphQL mutations interact with REST APIs managing the same resources
• Race conditions between GraphQL mutations and REST endpoints where state synchronization is non-atomic — these hit medium-to-high severity reliably
• Authorization persistence bugs where team/org/repo membership state is controlled by one API but readable/writable by another
• B2B SaaS platforms where one tenant affecting another via schema traversal = critical
• Internal admin GraphQL endpoints accidentally exposed to lower-privilege users

URL Patterns:

/graphql /api/graphql /v1/graphql /query /gql /graph /api/v2/graphql /internal/graphql

Response Headers:

Content-Type: application/json  (with query body) X-Request-Id + no REST-style path params = likely GraphQL

JavaScript Source Patterns:

// grep for these in JS bundles "query {" "mutation {" "__typename" "apollo" "ApolloClient" "graphql-tag" "gql`" "operationName" "GRAPHQL_URI"

Tech Stack Signals:

• Apollo Server/Client in JS bundles
• Relay in React apps
• graphene or strawberry (Python), graphql-ruby, gqlgen (Go), Lighthouse (Laravel)
• POST requests with {"query": "..."} body shape in Burp history
• __schema or __type in any response = confirmed GraphQL

• github.com search: "graphql" site:target.com
• Wayback Machine for /graphql paths
• JS bundle scanning with LinkFinder or getallurls

• Discover the endpoint — spider JS bundles, check /graphql, /api/graphql, review Burp passive scan hits for application/json POST with query fields
• Test introspection — send the full introspection query. Even if blocked, try field-level enumeration:

   { __typename }

• Map the full schema — use InQL (Burp extension) or graphql-voyager to visualize relationships. Specifically look for:

• Identify REST/GraphQL overlap — document every resource that can be modified via BOTH REST and GraphQL. These dual-write surfaces are your RC targets.
• Test authorization boundaries per mutation — replay mutations as lower-privilege users. Does the server enforce the same authz as the equivalent REST call?
• Hunt cross-API state desync — find sequences where:

• Test for persistent privilege after role/membership changes — remove a user via REST, then call the corresponding GraphQL mutation for that resource. Query current state via both APIs and compare.
• Probe for IDOR in node IDs — GraphQL global IDs often encode object type + ID. Swap IDs across object boundaries and across account contexts.
• Check batch query abuse — send arrays of operations to bypass rate limiting or amplify enumeration.
• Document the exact reproduction chain — for RC bugs, time-based steps must be reproducible deterministically.

Full Introspection Query:

{   __schema {     types {       name       fields {         name         type {           name           kind         }       }     }   } }

Minimal Introspection Probe (bypass attempt):

{ __typename }

curl introspection test:

curl -s -X POST https://target.com/graphql \   -H "Content-Type: application/json" \   -H "Authorization: Bearer YOUR_TOKEN" \   -d '{"query":"{ __schema { queryType { name } } }"}' | jq .

Field suggestion probe (bypass blind introspection blocks):

{ unknownField }

Batch query amplification:

[   {"query": "{ user(id: 1) { email } }"},   {"query": "{ user(id: 2) { email } }"},   {"query": "{ user(id: 3) { email } }"} ]

RC desync test pattern (pseudo-sequence):

# Step 1: Grant access via REST curl -X PUT https://api.target.com/repos/ORG/REPO/teams/TEAM \   -H "Authorization: token ADMIN_TOKEN" \   -d '{"permission":"admin"}'

# Step 2: Revoke via REST   curl -X DELETE https://api.target.com/repos/ORG/REPO/teams/TEAM \   -H "Authorization: token ADMIN_TOKEN"
# Step 3: Re-assert via GraphQL mutation curl -X POST https://api.target.com/graphql \   -H "Authorization: bearer ATTACKER_TOKEN" \   -d '{"query":"mutation { updateTeamsRepository(input: {repositoryId: \"REPO_ID\", teamId: \"TEAM_ID\", permission: ADMIN}) { clientMutationId } }"}'
# Step 4: Verify persistent access curl https://api.target.com/repos/ORG/REPO/teams \   -H "Authorization: token ADMIN_TOKEN"

Grep for GraphQL in JS bundles:

grep -Eo '(query|mutation|subscription)\s+\w+\s*[\({]' bundle.js grep -Eo '"(/[a-z0-9/_-]*graphql[a-z0-9/_-]*)"' bundle.js

InQL / clairvoyance for blind schema enumeration:

python3 clairvoyance.py -u https://target.com/graphql \   -H "Authorization: Bearer TOKEN" \   -w wordlist.txt -o schema.json

• Dual-write without atomic locking — developers implement the same resource modification in both REST and GraphQL independently. Neither system is aware the other exists for that resource. State updates aren't serialized or compared.
• Inconsistent authorization middleware — REST endpoints go through one auth layer (e.g., middleware chain), GraphQL resolvers go through a different resolver-level check. The same action, different enforcement.
• GraphQL as "new REST" migration — teams add GraphQL mutations that mirror REST functionality without auditing the permission model. The GraphQL version is less mature and skips checks the REST version accumulated over time.
• Introspection left on in production — default framework settings (Apollo, Graphene) enable introspection in all environments. Developers forget to disable it, treating it as "just documentation."
• Node ID trust without re-authorization — GraphQL global IDs (base64("ObjectType:123")) are decoded and trusted without verifying the requesting user has access to that specific object.
• Mutation side effects not mirrored — when a REST action triggers cascading effects (e.g., team removal cascades to permission revocation), the GraphQL equivalent mutation doesn't trigger the same cascades.

Defense: Introspection disabled

• Bypass via field suggestion errors — send invalid field names and parse "did you mean X?" responses
• Use clairvoyance to brute-force field names against a wordlist
• Check JS bundles for hardcoded query strings that reveal the schema

• Fragment spread to increase effective depth without hitting the limiter:

fragment F on User { repos { teams { members { ...F } } } }

Defense: Rate limiting per IP

• Use batch operations (array of queries in one POST)
• Distribute across authenticated sessions

• Test with tokens at different privilege tiers (viewer, member, admin)
• Test unauthenticated — some mutations don't check session at all
• Test with tokens from different organizations — multi-tenant IDOR

• Alias the introspection field:

{ s: __schema { t: types { n: name } } }

• Use HTTP parameter pollution or alternate content-type headers

• Check if the server falls back to ad-hoc queries when the extensions.persistedQuery hash mismatches
• Look for a non-whitelisted endpoint (dev, staging, internal proxy)

Alias batching: when it wins races vs when it doesn't

A common claim is "alias batching defeats per-user rate limits and double-spend protections." Whether this actually wins depends on the resolver execution model:

• 10 aliased redeemCoupon mutations in one request → only r1 succeeds, r2-r10 fail with already_redeemed. Alias batching alone is insufficient.
• The same 10 mutations as 20 parallel HTTP POSTs → 20 successes ($2000 from a $100 coupon).

• What can the attacker DO right now?

• What does the victim LOSE?

• Can it be reproduced in 10 minutes from scratch?

Scenario A — Covert Persistent Admin After Team Removal (GitHub-pattern) An attacker who legitimately had admin access to a repository via team membership gets removed by the org admin through the REST API. The attacker, before removal completes, calls the updateTeamsRepository GraphQL mutation to re-associate their team with admin permissions. The REST removal and GraphQL re-grant create a desync where the UI shows the team as removed, but the GraphQL state preserves admin-level access. The attacker retains covert write access to the repository indefinitely — pushing code, reading secrets in CI/CD — without appearing in the team's member list. This persists through org audits.

Scenario B — Covert Access via Repo Transfer Race (GitHub-pattern) An attacker with admin access initiates a repository transfer to another organization via the REST API. During or after the transfer, they invoke updateTeamsRepository on the now-transferred repo's ID. Because the GraphQL mutation doesn't validate current org ownership state consistently with the REST transfer event, the original attacker's team retains admin access on a repo now owned by a different organization. The receiving org has no visibility into this team association. The attacker can exfiltrate intellectual property from an org they have no legitimate relationship with.

Scenario C — Introspection as Reconnaissance Prerequisite (Shopify-pattern) On a platform where introspection is intentionally enabled (per-program rules), a hunter maps the full schema and discovers undocumented mutations for fulfillmentOrderMove and inventoryAdjust that are not surfaced in public docs. These mutations accept merchant IDs as arguments with no scoping validation visible in the schema. This recon directly enables targeted IDOR testing against merchant-to-merchant data isolation — the introspection itself is zero-severity, but it is the entry point to critical findings.

The following real, verified bug-bounty / coordinated-disclosure cases extend this skill beyond the original 3 internal references. Each is a distinct GraphQL subclass with a working PoC documented in the cited writeup.

• HackerOne — Confidential user-data exposure via GraphQL User type ([H1 #489146](https://hackerone.com/reports/489146))

• HackerOne — DestroyLlmConversation mutation IDOR (Copilot pre-release) ([H1 #2218334](https://hackerone.com/reports/2218334))

• Shopify — BillingDocumentDownload cross-tenant IDOR ([H1 #2207248](https://hackerone.com/reports/2207248))

• Shopify — Rate-limit bypass via negative cost ([H1 #481518](https://hackerone.com/reports/481518))

• Stripe — Cross-tenant IDOR via UpdateAtlasApplicationPerson ([H1 #1066203](https://hackerone.com/reports/1066203))

• EXNESS — SSRF in GraphQL allTicks query ([H1 #1864188](https://hackerone.com/reports/1864188))

• EXNESS — GraphQL attribute-batching DoS ([H1 #2293642](https://hackerone.com/reports/2293642))

• GitLab — Malicious-runner attach via runnerUpdate (CVE-2023-2478) ([Advisory](https://about.gitlab.com/releases/2023/05/05/critical-security-release-gitlab-15-11-2-released/))

• AS Watson — Auth bypass via unrestricted createAdminUser mutation ([HackerOne blog](https://www.hackerone.com/blog/how-graphql-bug-resulted-authentication-bypass))

• hunt-idor — GraphQL node(id:) and global-relay-ID resolvers are IDOR factories: same shape, no scoping. Chain primitive: GraphQL introspection + IDOR (node() resolver) → cross-tenant data via base64-decoded type:id replay.
• hunt-api-misconfig — GraphQL mutations are mass-assignment magnets: clients send full input objects, server merges. Chain primitive: GraphQL mutation + extra fields (isAdmin:true, verified:true) → mass assignment → role escalation.
• hunt-business-logic — GraphQL aliases let you call the same mutation N times in one request, defeating per-request rate limits. Chain primitive: aliased mutation + business-logic flaw → coupon redeemed N times in single network round-trip.
• hunt-race-condition — GraphQL batching collapses N mutations into one HTTP packet — perfect single-packet race vehicle. Chain primitive: GraphQL batch + race → atomic-update missing → double-spend balance.
• security-arsenal — Load the GraphQL Payload Pack: introspection query, schema-suggestion error probe, alias amplification template, depth-bomb DoS payload, batch-attack template.
• triage-validation — Apply the Body-Diff Rule: introspection alone is informational; require a concrete cross-tenant read or mutation-with-impact PoC before submitting.