CVE-2024-32971 - Apollo Router Cache Bug Can Execute Wrong Operations (Explained, With Exploit Scenario)

CVE-2024-32971 is a recently disclosed vulnerability in Apollo Router, a popular Rust-based graph router used to run federated supergraphs with Apollo Federation 2. This bug affects certain Apollo Router versions that use distributed query plan caching and can lead to unexpected—often dangerous—operations being executed on your backend.

In this article, we’ll break down the issue in plain English, show you how it happens, and provide practical advice (with code snippets) on how to protect your systems. We’ll also show what a practical exploit might look like.

What Is Apollo Router?

Apollo Router is the default gateway for federated GraphQL supergraphs. It’s highly configurable, fast, and built in Rust. In some setups, to improve performance and scalability, Router instances share cache across nodes (often with Redis) to store query plans, so repeated queries don’t have to be “planned” all over again.

The Short Version

When distributed query plan caching is enabled, Apollo Router could get confused and run the wrong operation—for example, you may ask it to fetch or delete some data, but it ends up doing something totally different (wrong user, wrong type, even wrong mutations).

Only routers using distributed query plan caching (with Redis or other distributed cache backends) are affected.

1.45.1 and above (recommended)

Affected users:
Anyone running a federated graph with Apollo Router using distributed query plan caching.

What Actually Goes Wrong

Apollo Router caches “query plans” based on request parameters. But a bug in the logic that retrieves these plans from the distributed cache means:

- Key Collisions or Mix-Ups: The router might re-use a query plan for one operation (say, deleting user 10) when handling a totally different operation (like deleting user 12).
- Unexpected Execution: The actual operation executed on your backend can be whatever is stored in cache, not what the user requested.

Surprising errors if the operation simply “doesn’t fit” the plan

Accidental data leaks or destructive actions are both on the table.

Real-World Exploit Scenario

Let’s see an example—this is how an attacker (or just a random user) could *accidentally* get the wrong data, or even trigger unintended effects.

Suppose your supergraph exposes this mutation

mutation deleteUser($id: Int!) {
  deleteUser(id: $id)
}

And you also have this query

query fetchUsers($type: UserType!) {
  fetchUsers(type: $type) {
    id
    name
  }
}

`

But due to the bug, the router fetches the wrong cached plan (say, the one for id:10), and executes that operation instead.

Proof-of-Concept Attack

Here’s a highly simplified (fake) snippet showing how this happens under the hood.

// Pseudocode - not the actual Apollo code

let cache_key = make_cache_key_from_graphql(query, variables);

// BAD: Due to bug, the cache key might not account for all request parameters
let query_plan = cache.get(cache_key).unwrap_or_else(|| {
    plan_query(query, variables)
});

// Router now executes the wrong operation plan
execute_plan(query_plan, actual_request_payload);

If the make_cache_key_from_graphql function skips some variable details (e.g., only uses the operation name), different operations (with different arguments) can map to the same key, and the wrong plan is used.


## How to Fix / Mitigate

The official fix is to upgrade

- Safe:     >= 1.45.1
- Or:       <= 1.43.2
- Do NOT use: 1.44. or 1.45.

*Apollo has withdrawn versions 1.44. and 1.45..*

2. If You Can’t Upgrade: Disable Distributed Query Plan Caching

In your router.yaml configuration, comment out or remove the section enabling distributed cache for query plans. For example:

query_planning:
  cache:
    # Remove or comment out your distributed cache configuration
    # redis:
    #   connection_string: "redis://user:password@redis:6379"

3. Monitor for Symptoms

- Audit your logs for suspicious or mismatched queries/mutations

Official References

- GitHub Security Advisory for Apollo Router
- Apollo Router Releases
- CVE Record at NIST (Check for updates)

Summary Table

| Version | Status | Mitigation |
|----------------|--------------|----------------------------------|
| ≤ 1.43.2 | ✅ SAFE | N/A |
| 1.44., 1.45. | ❌ VULNERABLE| Upgrade/Disable distributed cache|
| ≥ 1.45.1 | ✅ SAFE | N/A |

Conclusion

CVE-2024-32971 is subtle but critical. If you use distributed query plan caching in Apollo Router, you must upgrade now or disable the feature. Otherwise, you risk serving wrong data or deleting the wrong records—not just a theoretical issue, but a real data safety disaster.

Don’t wait. Update your Router or disable distributed caching today.


*Stay safe, and always keep your dependencies up to date. 🛡️*

> If you need more help, check the official Apollo docs and the GitHub advisory.

Timeline

Published on: 05/02/2024 07:15:21 UTC
Last modified on: 05/02/2024 13:27:25 UTC