GraphQL actions such as mutation and query have the ability to take an operation name as part of the query.
Here is an example query that uses MyName as an operation name:
query MyName {
getMyName
{
first
last
}
}
The application is keeping track of all queries and mutations users are executing on this system in order to display them in the audit log.
However, the application is not doing a fair job at verifying the operation name.
# Beginner mode:
# Log spoof the operation to getPaste instead of createPaste
mutation getPaste{
createPaste(title:"<script>alert(1)</script>", content:"zzzz", public:true) {
paste {
id
}
}
}
# Inject to the log arbitrary strings
query pwned {
systemHealth
}
# Expert mode:
Log injection should not be impossible due to operation name allow-listing. Only a selection of expected operation names can be provided.