CVE-2024-43783

Executive Summary

CVE-2024-43783 is a high-severity denial-of-service (DoS) vulnerability affecting the Apollo Router Core, a high-performance graph router written in Rust for federated supergraphs using Apollo Federation 2. The vulnerability allows an unauthenticated attacker to cause the Router to load entire HTTP request bodies into memory without respecting configured size limits, potentially leading to out-of-memory (OOM) termination. This issue impacts two specific configurations: External Coprocessing (versions >=1.21.0 and <1.52.1) and custom-developed Native Rust Plugins (versions >=1.7.0 and <1.52.1). The vulnerability is triggered when the Router is configured to send request bodies to coprocessors or when a Native Rust Plugin accesses and accumulates the request body in the RouterService layer. The CVSS score is 7.5 (High), with a low attack complexity and no required privileges or user interaction. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept (PoC) or exploit code is available at this time. The vendor, Apollo, has released a patch in version 1.52.1.

Supply Chain & Package Security

This vulnerability is in the Apollo Router, a Rust-based binary distributed via official channels (e.g., GitHub releases, Docker images). It is not a package manager vulnerability (NPM, PyPI, Go, Ruby). However, organizations using Apollo Router should verify the integrity of their downloaded binaries and ensure they are sourced from official Apollo repositories. The vulnerability does not introduce a supply chain risk through dependency confusion or malicious packages, but the impact on service availability could affect downstream consumers of the GraphQL API.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None (N) – No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The vulnerability can cause a complete denial of service (OOM termination).

Threat Level: High. The vulnerability is easy to exploit (low complexity, no privileges) and can cause significant service disruption. Although no public exploits exist, the attack surface is network-based, and the impact is severe.

Deep Dive & Mechanics

The Apollo Router is designed to handle GraphQL requests and route them to appropriate subgraphs. It includes features like External Coprocessing (for custom request/response processing) and Native Rust Plugins (for extending functionality). The vulnerability arises from improper memory management when handling HTTP request bodies.

Root Cause: The Router does not enforce the limits.http_max_request_bytes configuration (default 2 MB) when request bodies are processed by coprocessors or Native Rust Plugins. Instead, the entire body is loaded into memory without size checks, leading to potential OOM conditions.

Affected Configurations:

1. External Coprocessing: When coprocessor.router.request.body is set to true (non-default), the Router sends the full request body to the coprocessor. The body is loaded into memory without size limits.
2. Native Rust Plugin: When a custom plugin accesses Request.router_request in the RouterService layer and accumulates the body into memory, the same issue occurs.

Attack Vector: An attacker sends a crafted HTTP request with an excessively large body (e.g., >2 MB) to the Apollo Router. If the Router is configured with either of the vulnerable configurations, it will load the entire body into memory, potentially exceeding available memory and causing the process to be terminated by the OOM killer.

Impact: Denial of service. The Router becomes unavailable, affecting all GraphQL API consumers. In containerized environments (e.g., Kubernetes), the pod may be restarted, but repeated attacks can cause persistent disruption.

Vulnerable vs. Patched Code

The vulnerability is in the memory allocation logic for request bodies. The patched version (1.52.1) enforces the limits.http_max_request_bytes limit even when coprocessors or plugins are used.

Vulnerable Code (Conceptual):

// In coprocessor or plugin handler
let body = request.router_request.body().await?; // Loads entire body into memory
// Process body without size check

Patched Code (Conceptual):

// In coprocessor or plugin handler
let max_bytes = config.limits.http_max_request_bytes;
let body = request.router_request.body_with_limit(max_bytes).await?; // Enforces limit
// Process body with size check

The patch adds a size limit check before loading the body into memory. If the body exceeds the limit, the request is rejected with an error (e.g., 413 Payload Too Large).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• An Apollo Router instance running a vulnerable version (>=1.21.0 and <1.52.1 for coprocessing, or >=1.7.0 and <1.52.1 for plugins).
• The Router must be configured with External Coprocessing enabled and coprocessor.router.request.body set to true, OR a custom Native Rust Plugin that accumulates the request body.

Exploitation Steps:

1. Identify the target Apollo Router endpoint (e.g., https://graphql.example.com/graphql).
2. Craft a large HTTP POST request with a body exceeding the default 2 MB limit (e.g., 10 MB of random data).
3. Send the request using a tool like curl:

   curl -X POST https://graphql.example.com/graphql \
     -H "Content-Type: application/json" \
     --data-binary @large_payload.json
   

   Where large_payload.json is a file containing a large JSON payload (e.g., {"query": "..."} with a huge string).
4. Monitor the Router's memory usage. If successful, the Router process will be terminated by the OOM killer, causing a denial of service.

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team (Defense & Detection)

Detection:

• Monitor for HTTP requests with unusually large body sizes (e.g., >2 MB) to the Apollo Router endpoint.
• Alert on sudden spikes in memory usage on the Router host.
• Use network monitoring to detect large payloads in transit.

Mitigation:

• Upgrade to Apollo Router 1.52.1 or later.
• If upgrade is not possible:
  • For External Coprocessing: Set coprocessor.router.request.body to false.
  • For Native Rust Plugins: Modify the plugin to not accumulate the request body or enforce a maximum body size limit.
• Deploy a reverse proxy or Web Application Firewall (WAF) in front of the Router to limit HTTP body sizes (e.g., client_max_body_size 2M in Nginx).

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to the Apollo Router endpoint with body sizes exceeding the configured limits.http_max_request_bytes (default 2 MB).
  • Repeated requests with large payloads from the same source IP.
• System:
  • High memory usage by the apollo-router process.
  • OOM killer logs in /var/log/kern.log or dmesg (e.g., Out of memory: Killed process apollo-router).
  • Router process crashes or restarts.
• Application:
  • Error logs indicating "out of memory" or "cannot allocate memory".
  • HTTP 413 Payload Too Large responses (if a proxy enforces limits).

Detection Engineering

YARA Rule

rule CVE_2024_43783_Apollo_Router_OOM {
    meta:
        description = "Detects Apollo Router versions vulnerable to CVE-2024-43783"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-43783"
    strings:
        $version_string = "Apollo Router v" ascii wide
        $vuln_version_1 = "1.21." ascii wide
        $vuln_version_2 = "1.22." ascii wide
        $vuln_version_3 = "1.23." ascii wide
        $vuln_version_4 = "1.24." ascii wide
        $vuln_version_5 = "1.25." ascii wide
        $vuln_version_6 = "1.26." ascii wide
        $vuln_version_7 = "1.27." ascii wide
        $vuln_version_8 = "1.28." ascii wide
        $vuln_version_9 = "1.29." ascii wide
        $vuln_version_10 = "1.30." ascii wide
        $vuln_version_11 = "1.31." ascii wide
        $vuln_version_12 = "1.32." ascii wide
        $vuln_version_13 = "1.33." ascii wide
        $vuln_version_14 = "1.34." ascii wide
        $vuln_version_15 = "1.35." ascii wide
        $vuln_version_16 = "1.36." ascii wide
        $vuln_version_17 = "1.37." ascii wide
        $vuln_version_18 = "1.38." ascii wide
        $vuln_version_19 = "1.39." ascii wide
        $vuln_version_20 = "1.40." ascii wide
        $vuln_version_21 = "1.41." ascii wide
        $vuln_version_22 = "1.42." ascii wide
        $vuln_version_23 = "1.43." ascii wide
        $vuln_version_24 = "1.44." ascii wide
        $vuln_version_25 = "1.45." ascii wide
        $vuln_version_26 = "1.46." ascii wide
        $vuln_version_27 = "1.47." ascii wide
        $vuln_version_28 = "1.48." ascii wide
        $vuln_version_29 = "1.49." ascii wide
        $vuln_version_30 = "1.50." ascii wide
        $vuln_version_31 = "1.51." ascii wide
        $vuln_version_32 = "1.52.0" ascii wide
    condition:
        $version_string and any of ($vuln_version_*)
}

Sigma Rule

title: CVE-2024-43783 - Apollo Router OOM Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with large body sizes targeting Apollo Router endpoints, indicating potential exploitation of CVE-2024-43783.
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-43783
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/graphql'
        sc-bytes|gte: 2097152  # 2 MB in bytes
    condition: selection
falsepositives:
    - Legitimate large GraphQL queries (rare)
level: high
tags:
    - attack.t1499
    - cve.2024.43783

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-43783 Apollo Router OOM Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"/graphql"; http_uri; content:!"Referer"; http_header_names; pcre:"/^Content-Length:\s*\d{7,}$/mi"; threshold: type both, track by_src, count 1, seconds 60; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update the Apollo Router to version 1.52.1 or later. This is the only complete fix.
2. Configuration Change (if upgrade is not possible):
   • For External Coprocessing: Set coprocessor.router.request.body to false in the Router configuration.
   • For Native Rust Plugins: Modify the plugin to not accumulate the request body or enforce a maximum body size limit.
3. Network-Level Mitigation: Deploy a reverse proxy (e.g., Nginx, HAProxy) or WAF in front of the Router to enforce HTTP body size limits. Example Nginx configuration:

   server {
       client_max_body_size 2M;
       location /graphql {
           proxy_pass http://apollo_router;
       }
   }
   

Long-Term Recommendations:

• Implement monitoring for memory usage and HTTP request sizes.
• Regularly update the Apollo Router to the latest version.
• Review and audit all custom Native Rust Plugins for similar memory management issues.
• Consider using a Web Application Firewall (WAF) with rate limiting and payload inspection.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valtersit.com.