Horizon Alert
Summary of the vulnerability and why it matters
This critical vulnerability in Dgraph allows unauthenticated attackers to gain full read access to all data within the database. This issue arises from improper handling of user-supplied input in specific unauthenticated API requests, making it a significant risk for organizations using Dgraph without proper security configurations.
- Unauthenticated remote attackers can read all data.
- Affects default configurations without enabled access controls.
- Requires two specific HTTP POST requests.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability by sending two unauthenticated HTTP POST requests to a Dgraph instance. The first request alters the schema to create a specific predicate, and the second sends a crafted mutation. This allows the attacker to inject and execute arbitrary DQL queries on the server, granting them full read access to all data in the database.
- Unauthenticated access required
- Targets Dgraph's /alter and /mutate endpoints
- Exploits schema predicate injection
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows unauthenticated attackers to gain read access to all data in a Dgraph database if ACLs are not enabled, requiring only two HTTP POST requests to exposed endpoints. Attackers may favor this vulnerability due to its critical impact of complete data exfiltration and its apparent ease of exploitation, provided the targeted Dgraph instance is accessible over the network and not secured by default. However, the primary detractor is its likely limited scope, as Dgraph is typically deployed internally and not directly exposed to the internet.
- Exploitation requires network access.
- Dgraph typically internal.
- Unauthenticated data read access.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate patching of Dgraph to version 25.3.3 to address the critical unauthenticated data access vulnerability. If patching is not feasible, isolate affected Dgraph instances from untrusted networks to prevent exploitation.
- Apply Dgraph version 25.3.3.
- Restrict network access to port 8080.
- Monitor traffic for suspicious DQL injection patterns.
