Examining Access Control Vulnerabilities in GraphQL: A Feeld Case Study
Examines authorization and access control vulnerabilities in GraphQL and REST APIs, using the Feeld dating app data leak as a case study in data exposure.
Summary
API Access Control Mechanisms and Pitfalls
GraphQL provides flexible client-driven data querying across complex object graphs. However, decoupling query parsing from granular object-level authorization frequently introduces critical Broken Object Level Authorization (BOLA) vulnerabilities.
Case Study: Feeld Dating App Vulnerability
Security review of the Feeld dating application revealed missing access control checks across GraphQL queries and associated REST endpoints. By manipulating user identifiers and object parameters in nested queries, unauthorized clients could retrieve private user data.
Impact on Sensitive Personal Media and Communications
The authorization bypass exposed sensitive personal records, including unencrypted photos, private videos, and confidential user messages. The flaw illustrates how schema complexity can obscure missing authorization checks at the field resolver level.
Remediation and Secure GraphQL Architecture
Preventing GraphQL authorization flaws requires implementing field-level authorization middleware, validating user ownership at the data resolver layer, and enforcing strict schema querying boundaries.
Related talks
OWASP Foundation·41 min
Analysts investigate attack surfaces and defenses concerning APPSEC Cali 2018 - How Privacy Violations, Fines and Economic Sanctions Create Darker Opportunities.
Car Hacking Village·22 min
Eaton Zveare
Reveals critical API vulnerabilities in a major automotive dealer platform that allowed national admin account creation and remote vehicle command access.
Main Stage·35 min
Eaton Zveare · R Piyush
Reveals critical API authorization vulnerabilities in automotive dealer management systems that allowed national admin account creation and remote vehicle control.