{"id":"GHSA-68jh-rf6x-836f","aliases":[],"status":"published","title":"@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces","description":"### Context\nContent Security Policies (CSP) are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack.\n\n### Impact\nThere aren't any XSS attack vectors via the Apollo Server landing pages _known to Apollo_, so to our knowledge there is no impact. However, if there are existing XSS vectors that haven't been reported and patched, then all users of Apollo Server's landing pages have a vulnerability which won't be prevented by the current CSP implemented by the landing pages.\n\nPrior to version 4.7.1, there was no CSP implemented at all. However, the initial CSP implementation (4.7.1+) reused nonces. While this sufficiently resolved the issue w.r.t. scripts not running in Safari, it did not implement CSP in a safe or conventional way.\n\n### Patches\nThe issue is patched in the latest version of Apollo Server, v4.7.4. The changes can be reviewed in [the merge commit](https://github.com/apollographql/apollo-server/commit/0adaf80d1ee51d8c7e5fd863c04478536d15eb8c).\n\n### Workarounds\nThe landing page can be disabled completely until the patch can be upgraded to.\nhttps://www.apollographql.com/docs/apollo-server/api/plugin/landing-pages/#disabling-the-landing-page\n\n### References\nhttps://content-security-policy.com/nonce/","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-06-16T19:40:53Z","modified":"2023-06-20T19:50:43Z","fixes":[{"ecosystem":"npm","package":"@apollo/server","fixed_in":["4.7.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@apollo/server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.1"},{"fixed":"4.7.4"}]}]},{"source":"osv","ecosystem":"npm","package":"@apollo/server","ranges":[{"type":"SEMVER","events":[{"introduced":"4.7.1"},{"fixed":"4.7.4"}]}]}],"references":[{"url":"https://github.com/apollographql/apollo-server/security/advisories/GHSA-68jh-rf6x-836f","tags":["web"]},{"url":"https://github.com/apollographql/apollo-server/commit/0adaf80d1ee51d8c7e5fd863c04478536d15eb8c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-68jh-rf6x-836f"},{"url":"https://github.com/apollographql/apollo-server","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-68jh-rf6x-836f","title":"@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces","description":"### Context\nContent Security Policies (CSP) are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack.\n\n### Impact\nThere aren't any XSS attack vectors via the Apollo Server landing pages _known to Apollo_, so to our knowledge there is no impact. However, if there are existing XSS vectors that haven't been reported and patched, then all users of Apollo Server's landing pages have a vulnerability which won't be prevented by the current CSP implemented by the landing pages.\n\nPrior to version 4.7.1, there was no CSP implemented at all. However, the initial CSP implementation (4.7.1+) reused nonces. While this sufficiently resolved the issue w.r.t. scripts not running in Safari, it did not implement CSP in a safe or conventional way.\n\n### Patches\nThe issue is patched in the latest version of Apollo Server, v4.7.4. The changes can be reviewed in [the merge commit](https://github.com/apollographql/apollo-server/commit/0adaf80d1ee51d8c7e5fd863c04478536d15eb8c).\n\n### Workarounds\nThe landing page can be disabled completely until the patch can be upgraded to.\nhttps://www.apollographql.com/docs/apollo-server/api/plugin/landing-pages/#disabling-the-landing-page\n\n### References\nhttps://content-security-policy.com/nonce/","status":"published","published":"2023-06-16T19:40:53Z","modified":"2023-06-20T19:50:43Z","updated_at":"2026-11-02T14:36:55.184601Z"}],"osv":[{"id":"GHSA-68jh-rf6x-836f","title":"@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces","description":"### Context\nContent Security Policies (CSP) are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack.\n\n### Impact\nThere aren't any XSS attack vectors via the Apollo Server landing pages _known to Apollo_, so to our knowledge there is no impact. However, if there are existing XSS vectors that haven't been reported and patched, then all users of Apollo Server's landing pages have a vulnerability which won't be prevented by the current CSP implemented by the landing pages.\n\nPrior to version 4.7.1, there was no CSP implemented at all. However, the initial CSP implementation (4.7.1+) reused nonces. While this sufficiently resolved the issue w.r.t. scripts not running in Safari, it did not implement CSP in a safe or conventional way.\n\n### Patches\nThe issue is patched in the latest version of Apollo Server, v4.7.4. The changes can be reviewed in [the merge commit](https://github.com/apollographql/apollo-server/commit/0adaf80d1ee51d8c7e5fd863c04478536d15eb8c).\n\n### Workarounds\nThe landing page can be disabled completely until the patch can be upgraded to.\nhttps://www.apollographql.com/docs/apollo-server/api/plugin/landing-pages/#disabling-the-landing-page\n\n### References\nhttps://content-security-policy.com/nonce/","status":"published","published":"2023-06-16T19:40:53Z","modified":"2023-06-20T19:50:40Z","updated_at":"2026-11-02T15:46:39.266402Z"}]}}