CVE-2025-64173

Executive Summary

CVE-2025-64173 is a high-severity vulnerability in Apollo Router Core, a configurable graph router written in Rust used to run federated supergraphs with Apollo Federation 2. The vulnerability allows unauthenticated queries to access data that should require additional access controls. The root cause is an incorrect handling of access control directives (@authenticated, @requiresScopes, @policy) on interface types/fields and their implementing object types/fields. When all implementations of an interface have the same access control requirements, the router incorrectly applies directives from the interface type/fields while ignoring directives on the implementing object types/fields. This can lead to unauthorized data access.

Supply Chain & Package Security

This vulnerability affects the Apollo Router Core, which is distributed as a Rust crate and a Docker image. Users should verify the integrity of their downloaded packages and ensure they are using a patched version. The official source for the package is the Apollo GraphQL GitHub repository and the Rust crate registry (crates.io). No known supply chain attacks have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is high due to the low attack complexity and the potential for unauthorized access to sensitive data. The vulnerability can be exploited remotely without authentication.

Deep Dive & Mechanics

The vulnerability lies in the Apollo Router's handling of GraphQL directives for access control on polymorphic types. In GraphQL, an interface defines a set of fields that implementing object types must include. Access control directives like @authenticated, @requiresScopes, and @policy can be applied to both interface types/fields and object types/fields.

The intended behavior is that the router should enforce the most restrictive set of directives when resolving a field on an object type that implements an interface. However, due to a logic error, when all implementing object types have the same access control requirements, the router incorrectly applies only the directives from the interface type/fields, ignoring the directives on the implementing object types.

For example, consider an interface Node with a field id that has no access control directives. An object type User implements Node and has a field email that requires the @authenticated directive. If all other implementations of Node also require @authenticated on their respective fields, the router might incorrectly allow unauthenticated access to the email field on User because it only checks the interface's directives.

This bypasses the intended access control, allowing unauthenticated users to query data that should be protected.

Vulnerable vs. Patched Code

The vulnerable code is in the Apollo Router's directive resolution logic. The exact code is not publicly available, but the fix involves correcting the logic to properly evaluate directives on both interface and object types.

Vulnerable Logic (Conceptual):

// Pseudocode for vulnerable logic
fn resolve_directives(field: &Field, interface: &Interface) -> Vec<Directive> {
    let interface_directives = get_directives(interface);
    let object_directives = get_directives(field.object_type);
    // Incorrectly returns only interface directives if all objects have same directives
    if all_objects_have_same_directives(field.object_type) {
        return interface_directives;
    }
    // Otherwise, merge directives
    merge_directives(interface_directives, object_directives)
}

Patched Logic (Conceptual):

// Pseudocode for patched logic
fn resolve_directives(field: &Field, interface: &Interface) -> Vec<Directive> {
    let interface_directives = get_directives(interface);
    let object_directives = get_directives(field.object_type);
    // Always merge directives, taking the most restrictive
    merge_directives(interface_directives, object_directives)
}

The patch ensures that directives from both the interface and the implementing object type are always considered, preventing the bypass.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would need to identify an Apollo Router instance that uses inconsistent access control directives on polymorphic types. The attacker would then craft a GraphQL query that targets a field on an object type that implements an interface, where the interface has weaker or no access control directives compared to the object type.

Example Attack Query:

query {
  users {
    email  # This field should require @authenticated, but might be accessible without it
  }
}

Lab Setup:

1. Deploy an Apollo Router with a federated supergraph that includes an interface and an object type with inconsistent directives.
2. Configure the router to use version 1.61.11 or 2.8.1-rc.0.
3. Send the attack query without authentication.
4. Observe that the query returns data that should be protected.

Blue Team

To detect exploitation attempts, monitor for GraphQL queries that access fields on object types implementing interfaces, especially if the queries are unauthenticated. Look for patterns where the query structure suggests a bypass of access control.

Detection Steps:

1. Enable detailed logging on the Apollo Router.
2. Monitor logs for queries that access fields with @authenticated, @requiresScopes, or @policy directives without proper authentication.
3. Set up alerts for unusual query patterns, such as a high volume of queries targeting interface implementations.

Indicators of Compromise (IOCs)

• Network Traffic: GraphQL queries that access fields on object types implementing interfaces without authentication tokens.
• Log Entries: Router logs showing successful queries to fields that should require authentication, especially if the query lacks the expected authorization headers.
• Error Patterns: Absence of authentication errors for queries that should trigger them.

Detection Engineering

YARA Rule

rule CVE_2025_64173_Apollo_Router_Access_Control_Bypass {
    meta:
        description = "Detects Apollo Router configurations vulnerable to CVE-2025-64173"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-64173"
    strings:
        $vulnerable_version = /apollo-router[_-]v?(1\.61\.[0-9]|1\.61\.1[0-1]|2\.[0-7]\.[0-9]|2\.8\.[0-1]-rc\.0)/
        $directive_pattern = /@(authenticated|requiresScopes|policy)/
    condition:
        $vulnerable_version and #directive_pattern > 2
}

Sigma Rule

title: Apollo Router Access Control Bypass (CVE-2025-64173)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2025-64173 in Apollo Router logs
author: Valters IT
date: 2025-01-01
logsource:
    category: application
    product: apollo_router
detection:
    selection:
        event: "query_executed"
        query: "*@authenticated*" or "*@requiresScopes*" or "*@policy*"
        authentication: "none"
    condition: selection
falsepositives:
    - Legitimate unauthenticated queries to public fields
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64173 Apollo Router Access Control Bypass"; flow:to_server; content:"POST"; http_method; content:"/graphql"; http_uri; content:"@authenticated"; distance:0; content:"@requiresScopes"; distance:0; content:"@policy"; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Apollo Router to version 1.61.12 or 2.8.1 (or later).
2. Workaround: If immediate upgrade is not possible, review and align access control directives on interface and object types to ensure consistency. Apply the most restrictive directives to both the interface and all implementing object types.
3. Monitoring: Enable detailed logging and monitor for unauthorized access attempts.
4. Network Segmentation: Restrict network access to the Apollo Router to trusted sources only.
5. Web Application Firewall (WAF): Deploy a WAF with rules to detect and block GraphQL queries that attempt to bypass access controls.

Valters IT
Securing Digital Frontiers