GHSA-j5g3-5c8r-7qfx: 
Apollo Server vulnerability analysis and mitigation

A low severity vulnerability was discovered in Apollo Server affecting versions < 4.9.3 of @apollo/server and versions < 2.26.1 and < 3.12.1 of apollo-server-core. The vulnerability, identified as GHSA-j5g3-5c8r-7qfx, could potentially expose sensitive information (Studio API keys) when they are passed incorrectly with leading/trailing whitespace or contain invalid header value characters (GitHub Advisory).

The vulnerability occurs when Apollo Server processes API keys that contain invalid header values or whitespace. The issue specifically affects users who utilize schema reporting or usage reporting features, use an Apollo Studio API key with invalid header values, and employ the default fetcher (node-fetch) or a configured node-fetch fetcher. When an API key contains invalid characters, node-fetch throws an error containing the header value, which gets logged through the console or configured logging service (GitHub Advisory).

The primary impact is the potential exposure of sensitive Apollo Studio API keys through error logs. This occurs when API keys contain invalid characters or whitespace, causing them to be logged in error messages that might be visible in console outputs or logging services (GitHub Advisory).

The vulnerability is exploitable when specific conditions are met: the user must be using schema reporting or usage reporting features, have an API key with invalid header values, and be using node-fetch as their fetcher. The exposure occurs through logging mechanisms rather than direct exploitation (GitHub Advisory).

The vulnerability has been patched in Apollo Server versions 4.9.3 and apollo-server-core versions 2.26.1 and 3.12.1. The fix implements three main changes: trimming whitespace from incoming API keys with a warning, validating API keys against node-fetch header value requirements on startup, and throwing an error during startup if invalid characters are detected. Temporary workarounds include retrieving a new API key from Studio, overriding the fetcher, or disabling schema reporting and usage reporting features (GitHub Advisory).