🧪 Labs › APIs
GraphQL Exposure
Severity: Medium
A single flexible endpoint that often tells you more than it should.
What it is
GraphQL exposes one endpoint that answers richly-shaped queries. That flexibility is the risk: introspection can reveal the entire schema, and per-field authorization is easy to get wrong, so a query can stitch together data the UI never shows.
Common issues: introspection left on in production, object-level access control missing on nested fields, and batching that enables brute force.
The result is data exposure and access-control bypass through a legitimate-looking query.
How to approach it
- Ask the endpoint to describe itself — the schema tells you every type, field, and mutation available.
- Look for fields and mutations the UI doesn't use, especially ones returning other users' objects.
- Walk nested relationships to reach data that should be protected, and test whether authorization is enforced per field.
- Reason about what the schema reveals about the system behind it.
Your task
Use the API's own schema to retrieve data that the interface never exposes.
▶ Access the labOpens your hosted RatCTF instance. Work on it directly — there's nothing to submit here; you'll know when you've solved it.
How to prevent it
- Disable introspection in production and enforce object-level authorization on every resolver.
- Apply query depth/complexity limits and rate limiting.
- Return only the fields a caller is entitled to.