Miscellaneous :: GraphQL Query Weak Password Protection


Problem Statement

The query systemDiagnostics is an administrative functionality that allows running a subset of system commands on the server. The query is governed by a username and password before processing the command.

The password is weak, and the server has no rate limiting protections. This allows attackers to easily conduct brute force attacks against the server.

Resources
Exploitation Solution