CVE-2021-47715: 
Hasura vulnerability analysis and mitigation

CVE-2021-47715 is a Server-Side Request Forgery (SSRF) vulnerability in Hasura GraphQL Engine version 1.3.3. It allows unauthenticated attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint by sending crafted POST requests to the /v1/query endpoint, potentially enabling access to internal network resources. The CVE was published on December 22, 2025, and was assigned by VulnCheck. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (VulnCheck Advisory, Exploit-DB).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and exists in the add_remote_schema functionality of Hasura GraphQL Engine 1.3.3. An attacker can send a crafted HTTP POST request to the /v1/query endpoint with a malicious URL in the remote schema definition, causing the server to initiate outbound connections to attacker-controlled or internal network addresses without authentication. No special privileges or user interaction are required, making this exploitable by any network-accessible attacker. A public proof-of-concept exploit is available on Exploit-DB (Exploit-DB, VulnCheck Advisory).

Successful exploitation allows unauthenticated attackers to cause the Hasura GraphQL Engine server to make arbitrary HTTP requests to internal or external resources, potentially exposing internal network topology, cloud metadata endpoints (e.g., AWS IMDSv1), or other services not intended to be publicly accessible. The primary impact is on integrity (low) and potential indirect confidentiality exposure through sub-system interactions, as reflected in the CVSS v4.0 scoring. Availability is not directly impacted, but the vulnerability could facilitate reconnaissance for further lateral movement within internal networks (VulnCheck Advisory).

A public proof-of-concept exploit is available on Exploit-DB (EDB-ID 49791) and referenced by VulnCheck, indicating the vulnerability is readily exploitable (Exploit-DB, VulnCheck Advisory). No authentication is required, and the attack complexity is low. The EPSS score is approximately 0.026% (0.000260), suggesting low but non-zero probability of exploitation in the wild. There is no current evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify publicly accessible Hasura GraphQL Engine instances running version 1.3.3 using tools like Shodan or Censys, searching for exposed /v1/query endpoints.
2. Craft malicious payload: Prepare a JSON POST body targeting the add_remote_schema action with a malicious URL pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata, or an internal service IP):

{
  "type": "add_remote_schema",
  "args": {
    "name": "attacker_schema",
    "definition": {
      "url": "http://169.254.169.254/latest/meta-data/",
      "headers": [],
      "forward_client_headers": false,
      "timeout_seconds": 60
    }
  }
}

3. Send the request: Submit the crafted POST request to the target's /v1/query endpoint without any authentication headers.
4. Analyze the response: Observe the server's response or error messages, which may reflect content from the internal resource, confirming SSRF and revealing internal network information.
5. Pivot: Use discovered internal endpoints or credentials (e.g., cloud IAM tokens from metadata services) for further lateral movement (Exploit-DB, VulnCheck Advisory).

• Network: Unexpected outbound HTTP/HTTPS connections from the Hasura server to internal IP ranges (RFC 1918: 10.x.x.x, 172.16.x.x, 192.168.x.x) or cloud metadata endpoints (169.254.169.254).
• Network: Outbound connections to unusual external hosts initiated by the Hasura GraphQL Engine process.
• Logs: HTTP POST requests to /v1/query with a type field of add_remote_schema and suspicious or internal URLs in the definition.url field in Hasura access logs.
• Logs: Error messages in Hasura logs referencing failed or successful connections to internal network addresses triggered by remote schema operations.
• Process: The Hasura GraphQL Engine process initiating unexpected network connections to non-GraphQL backend addresses.

Users should upgrade Hasura GraphQL Engine from version 1.3.3 to a later patched release; patch availability for this specific CVE has not been explicitly confirmed by the vendor, so users should consult the Hasura GitHub repository for the latest release notes. As interim mitigations: restrict network access to the /v1/query endpoint using firewall rules or API gateway policies; implement strict allowlisting of permitted remote schema URLs; use network segmentation to prevent the Hasura server from reaching internal-only resources; and enforce authentication/authorization controls on the metadata API. Monitoring and alerting on unexpected outbound connections from the Hasura server is also recommended (VulnCheck Advisory, Hasura GitHub).