id: graphql-field-suggestion

info:
  name: GraphQL Field Suggestion Information Disclosure
  author: Dolev Farhi
  severity: info
  description: |
    If introspection is disabled on your target, Field Suggestion can allow users to still earn information on the GraphQL schema.
    By default, GraphQL backends have a feature for fields and operations suggestions.
    If you try to query a field but you have made a typo, GraphQL will attempt to suggest fields that are similar to the initial attempt.
  reference:
    - https://github.com/webonyx/graphql-php/issues/454
    - https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application
    - https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html
    - https://graphql.security
  metadata:
    max-request: 2
  tags: graphql,misconfig,vuln

http:
  - raw:
      - |
        POST /graphql HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"query":"query {\n  __schema {\n directive\n }\n}","variables":null}
      - |
        POST /api/graphql HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"query":"query {\n  __schema {\n directive\n }\n}","variables":null}

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Did you mean"

      - type: word
        part: header
        words:
          - "application/json"
# digest: 4b0a00483046022100eb6e215492ca6cc73c6cb585e4f9c22752ea37953fa24b455c02ba13e62f4c55022100f4e654c68c5eea10407eede547e5e2f3b178a98ced4f110d12a850e602914a5e:922c64590222798bb761d5b6d8e72950