birkir prime <= 0.4.0.beta.0 - Cross-Site Request Forgery in GraphQL

The XSRF vulnerability in birkir prime allows an attacker to trick a legitimate user into unknowingly executing actions on their behalf. By crafting a malicious GET request and enticing a user to click a link or visit a compromised page, an attacker can manipulate GraphQL query parameters to trigger actions as that user. This could include data modification, privilege escalation, or other unauthorized operations, depending on the user's permissions and the available GraphQL queries. The potential blast radius is significant, especially if privileged users are targeted, as an attacker could gain control over sensitive data or system functionalities.

Organizations and individuals utilizing birkir prime versions 0.0 through 0.4.0.beta.0 are at risk. This includes deployments where the GraphQL endpoint is exposed to untrusted networks or users, and those lacking robust input validation and output encoding mechanisms.

1. 2026-01-29Disclosure

   disclosure

1. Gereserveerd2026-01-29
2. Gepubliceerd2026-01-29
3. Gewijzigd2026-03-05
4. EPSS bijgewerkt2026-03-23

Due to the lack of a specific fixed version, immediate mitigation strategies are crucial. Implement strict input validation and output encoding on all GraphQL queries to prevent malicious parameter manipulation. Consider implementing anti-CSRF tokens for all sensitive operations within the GraphQL endpoint. Web application firewalls (WAFs) configured to detect and block suspicious GET requests targeting the GraphQL endpoint can provide an additional layer of protection. Regularly review and audit GraphQL query permissions to minimize the potential impact of successful exploitation. Monitor access logs for unusual activity and patterns indicative of XSRF attacks.