SS-2018-024: GraphQL does not validate X-CSRF-TOKEN
- Medium (?)
- Versions Affected:
- Versions Fixed:
- silverstripe/graphql:4.0.6, silverstripe/graphql:4.1.4, silverstripe/graphql:4.2.3, silverstripe/graphql:4.3.0
- Release Date:
While the admin modules were sending the appropriate X-CSRF-TOKEN header in all requests, the GraphQL server was not validating them, thereby leaving itself open to CSRF exploitation, particularly on destructive operations.