apollo-server-express dependency on cookie <7.0 (CVE-2024-47764)

[WilliamForbesJr]

Issue Description

Express dependency on cookie <7.0 CVE-2024-47764

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the cookie name, path, or domain, which can be used to set unexpected values to other cookie fields.

Link to Reproduction

GHSA-pxg6-pf52-xh8x

Reproduction Steps

Express dependency on cookie <7.0 CVE-2024-47764

[glasser]

I'll put out a patch release that includes this upgrade, because it's nice to not have copies of modules with CVEs installed in your server. However, I don't think there's an actual vulnerability here (assuming you are using Apollo Server in a typesafe way respecting our TypeScript declarations).

Apollo Server 4 uses Express in two ways.

First, it exports an expressMiddleware function. The code for this function does not actually link in any code from express at runtime — the caller of this function needs to install their own copy of express and create the Express app that way. So while users of expressMiddleware should upgrade their copy of express to avoid this CVE, whether or not @apollo/server was built against an older version is not relevant.

Second, it exports startStandaloneServer, which actually does create an Express app. The only vulnerable part of Express (as far as I can tell) are the res.cookie and res.clearCookie functions. A user of startStandaloneServer could hypothetically call these functions in their context function. But they should not — the context function passed to startStandaloneServer explicitly chooses to define its options using types from the base Node http package rather than Express types, because depending on the internal fact that startStandaloneServer is built on Express is not intended. So the only way to call the res.cookie/res.clearCookie functions is to ignore the type declarations for startStandaloneServer (whether by using an unsafe language like JavaScript or an as cast in TypeScript). You can introduce arbitrary security problems into your code if you override our type safety requirements, so I don't consider this to be a real vulnerability in Apollo Server 4.

(Apollo Server 2 and 3 have a different relationship to Express, in the apollo-server-express package instead of @apollo/server; however, these versions are end-of-life and we no longer guarantee security updates. Additionally, express is a peer dependency of apollo-server-express rather than a direct dependency, which means users of these obsolete versions just need to upgrade their own dependency on express to get the right version.)

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
For general questions, we recommend using StackOverflow or our discord server.