CVE-2021-47715

MEDIUM

Hasura Graphql Engine - SSRF

Title source: rule

Description

Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/query endpoint with malicious URL definitions to potentially access internal network resources.

Exploits (1)

exploitdb WORKING POC

by Dolev Farhi · pythonwebappsmultiple

https://www.exploit-db.com/exploits/49791

View Code ZIP pw:eip

References (3)

[Product] https://github.com/hasura/graphql-engine

[Exploit] https://www.exploit-db.com/exploits/49791

[Third Party Advisory, Exploit] https://www.vulncheck.com/advisories/hasura-graphql-server-side-request-forgery-via-remote-schema-injection

Scores

CVSS v3 5.3

EPSS 0.0006

EPSS Percentile 19.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Details

CWE

CWE-918

Status published

Products (1)

hasura/graphql_engine 1.3.3

Published Dec 22, 2025

Tracked Since Feb 18, 2026