Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in the Hot Chocolate GraphQL server allows an attacker to crash the entire worker process by sending a specially crafted, deeply nested query. This causes a `StackOverflowException` that cannot be caught, disrupting service for all users connected to that process.
- Disrupts service for all users.
- Affects any public GraphQL endpoint.
- Potentially impacts business operations.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this by sending a specially crafted, deeply nested GraphQL query to a vulnerable Hot Chocolate server. This would cause the parser to consume excessive stack space, leading to a denial-of-service by crashing the entire worker process. This attack requires no prior authentication and can be performed remotely.
- Unauthenticated network access needed.
- Target GraphQL endpoint.
- Maliciously structured query.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows for denial-of-service attacks by crashing the worker process via crafted GraphQL requests. While the vulnerability is in a component that processes requests, its exploitation may be limited due to the specific nature of the crash and the uncatchable `StackOverflowException` in .NET. Attackers might favor this type of vulnerability for disruption if it can be reliably triggered remotely with minimal effort.
- No public exploits observed.
- No KEV listing signals observed.
- Vulnerability is in a core parsing function.
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize upgrading Hot Chocolate to patched versions to prevent uncatchable `StackOverflowException` crashes. The vulnerability can lead to worker process termination, impacting all active requests and services.
- Upgrade to 12.22.7, 13.9.16, 14.3.1, or 15.1.14.
- Limit HTTP request body size at the proxy.
- Monitor for worker process restarts.
