GHSA-8r69-3cvp-wxc3: 
JavaScript vulnerability analysis and mitigation

A moderate severity vulnerability was discovered in Apollo Server versions 3 and 4 (specifically apollo-server-core >=3.0.0, <3.11.0 and @apollo/server <4.1.0) where the cache-control HTTP response header may not correctly reflect the cache policy for HTTP requests containing multiple operations using HTTP batching. The vulnerability was disclosed on November 2, 2022, and affects the caching behavior of batched GraphQL operations (GitHub Advisory).

The issue occurs when plugins set HTTP response headers for batched requests, where separate response headers are assembled in parallel for each operation and then merged together. If plugins set the same header on multiple operations, one value is chosen arbitrarily. This means that for a batched HTTP request with operations having different cache policies, the server would return a cache-control header that only applies to one of the operations, potentially leading to incorrect caching behavior. The vulnerability is specifically related to the cache-control header feature based on field- and operation-specific cache hints, and not the 'response cache plugin' (GitHub Advisory).

The vulnerability could lead to data being inappropriately cached and shared, potentially enabling cache poisoning attacks. In scenarios where a client sends an operation that should not be cached (due to session-specific information) alongside a cacheable operation, an attacker could manipulate the cache to store their response, causing other users to see the attacker's session-specific response instead of their own. However, since this only affects POST requests, the impact is limited as many browser and CDN caches don't typically cache POST requests (GitHub Advisory).

The vulnerability requires specific conditions to be exploitable: the system must be using HTTP batching with multiple operations that have different caching policies, and the cache infrastructure must be configured to cache POST requests. The issue is more likely to manifest during normal operation before it could be exploited maliciously, leading users to disable the problematic features (GitHub Advisory).

The issue has been patched in Apollo Server v3.11.0 and v4.1.0. For Apollo Server 3, upgrading to v3.11.0 restores the Apollo Server 2 behavior where the cache control plugin never sets the cache-control header on batched requests. For Apollo Server 4, upgrading to v4.1.0 implements proper header merging across operations. Alternative workarounds include disabling HTTP batching by setting allowBatchedHttpRequests: false, or disabling the cache-control header feature by adding ApolloServerPluginCacheControl({ calculateHttpHeaders: false }) to the plugins list (GitHub Advisory).