{"id":"GHSA-68jh-rf6x-836f","summary":"@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces","details":"### Context\nContent Security Policies (CSP) are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack.\n\n### Impact\nThere aren't any XSS attack vectors via the Apollo Server landing pages _known to Apollo_, so to our knowledge there is no impact. However, if there are existing XSS vectors that haven't been reported and patched, then all users of Apollo Server's landing pages have a vulnerability which won't be prevented by the current CSP implemented by the landing pages.\n\nPrior to version 4.7.1, there was no CSP implemented at all. However, the initial CSP implementation (4.7.1+) reused nonces. While this sufficiently resolved the issue w.r.t. scripts not running in Safari, it did not implement CSP in a safe or conventional way.\n\n### Patches\nThe issue is patched in the latest version of Apollo Server, v4.7.4. The changes can be reviewed in [the merge commit](https://github.com/apollographql/apollo-server/commit/0adaf80d1ee51d8c7e5fd863c04478536d15eb8c).\n\n### Workarounds\nThe landing page can be disabled completely until the patch can be upgraded to.\nhttps://www.apollographql.com/docs/apollo-server/api/plugin/landing-pages/#disabling-the-landing-page\n\n### References\nhttps://content-security-policy.com/nonce/","modified":"2023-06-20T19:50:40Z","published":"2023-06-16T19:40:53Z","database_specific":{"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2023-06-16T19:40:53Z","nvd_published_at":null,"cwe_ids":[]},"references":[{"type":"WEB","url":"https://github.com/apollographql/apollo-server/security/advisories/GHSA-68jh-rf6x-836f"},{"type":"WEB","url":"https://github.com/apollographql/apollo-server/commit/0adaf80d1ee51d8c7e5fd863c04478536d15eb8c"},{"type":"PACKAGE","url":"https://github.com/apollographql/apollo-server"}],"affected":[{"package":{"name":"@apollo/server","ecosystem":"npm","purl":"pkg:npm/%40apollo/server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.7.1"},{"fixed":"4.7.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-68jh-rf6x-836f/GHSA-68jh-rf6x-836f.json"}}],"schema_version":"1.9.0"}