A newly found vulnerability in GraphQL query language for application programming interfaces has been found to expose a leading business-to-business financial technology company.

While the exposed company was not named, the GraphQL vulnerability was uncovered and detailed today by researchers at the API security firm Salt Security Inc. The vulnerability was identified by researching the mobile applications and SaaS platform of the unnamed fintech provider and is said to call attention to authorization-level flaws that can arise with nested queries in GraphQL.

The researchers found that a failure to implement authorization checks meant the researchers could submit unauthorized transactions against any customer account and harvest any customer’s sensitive data. In this case, the GraphQL authorization flaw allowed attackers to manipulate API calls to exfiltrate sensitive user data and initiate unauthorized transactions.

The financial technology platform also introduced an additional security gap, in which some API calls accessed an API endpoint that required no authentication. The researchers could enter any transaction identifier and pull back data records of previous financial transactions.

Across the two vulnerabilities, any user could extract sensitive personally identifiable information and transfer funds out of customers’ accounts without their knowledge.

The researchers note that flexibility and complexity increase the difficulty of securing GraphQL APIs. Machine assistance is said to be essential to analyze the large amounts of API telemetry data necessary to identify access control flaws and behavioral anomalies. API gateways and web application firewalls cannot protect against these attack vectors and developers cannot identify all issues without the APIs being exercised in runtime.

“GraphQL provides some advantages in query options compared to REST APIs. With this flexibility, however, comes risk, since a single API call can include multiple separate queries,” Roey Eliyahu, co-founder and chief executive officer of Salt Security, said in a statement. “As GraphQL gains traction, our goal is to provide users with the intelligence, capabilities and support to develop more secure API environments.”

Image: GraphQL