GraphQL Batching Attacks: My Wild Ride into Modern API Vulnerabilities

Amin Hosseini — Thu, 17 Apr 2025 12:41:31 +0000

GraphQL Batching Attacks: My Wild Ride into Modern API Vulnerabilities
Introduction

A couple of months back, I was working on a penetration testing gig for an e-commerce platform that had just switched their APIs to GraphQL. They were super excited about how fast and flexible GraphQL was, but me? I’m a cybersecurity guy—I know these shiny new toys can sometimes bite back! While poking around during the recon phase, I stumbled upon a vulnerability that made my jaw drop: GraphQL Batching Attacks. This little adventure not only uncovered a critical issue for my client but also sent me down a rabbit hole of modern API risks. In this article, I’m gonna share my story, break down this sneaky vulnerability, and show you how to keep your APIs safe. So, buckle up—we’re going on a little hacking ride!
My Personal Encounter

It all started when I was digging into the client’s GraphQL API. I noticed they supported query batching—you know, that feature where you can send a bunch of queries in one HTTP request. My inner pentester got curious, so I threw together a batch request with 50 queries to pull user data, thinking, “There’s no way this’ll work—servers aren’t that chill, right?” Well, guess what? The server was way too chill! It processed all 50 queries like a champ and handed me a treasure trove of sensitive data—customer names, emails, even some payment details. It was like the server rolled out a red carpet and said, “Here’s the keys to the kingdom, enjoy!”

I reported the issue to the client right away, but that experience got me thinking: how many other GraphQL APIs out there are this vulnerable? That’s when I dove into GraphQL Batching Attacks to learn more—and now I’m here to spill the beans.
What Is GraphQL and Why Does It Matter?

GraphQL is a query language for APIs that lets clients ask for exactly the data they need. Unlike REST, where you might need to send a dozen requests to get related data, GraphQL says, “Just one request, and I’ll hook you up with everything!” It’s pretty awesome, but if you’re not careful with security, your API might end up chatting with hackers more than you’d like.

One cool feature of GraphQL is Batching, which lets you bundle multiple queries into a single request. It’s great for cutting down on network traffic, but if you don’t set it up right, it can turn into a hacker’s playground—just like I saw in my project.
The Vulnerability: What Are GraphQL Batching Attacks?

Batching Attacks happen when an attacker abuses the ability to send multiple queries in one request to either overwhelm the server, steal sensitive data, or sneak past authentication checks. These attacks usually exploit three big weaknesses in GraphQL setups:

No Query Limits: If the server doesn’t cap the number of queries in a batch, an attacker can send hundreds—or thousands!—of queries in one go, either crashing the server (DoS) or grabbing a ton of data.
Overfetching and Underfetching: GraphQL lets clients decide what data they want. If validation isn’t tight, attackers can grab stuff they shouldn’t (Overfetching) or skip queries to mess with security logic (Underfetching).
Authentication Gaps: Some servers only check authentication for the whole request, not each query in the batch. That means an attacker can hide an unauthorized query in the middle of legit ones, and the server’s like, “Looks good to me!”

Real-World Example

In my client’s case, their e-commerce GraphQL API let me send a batch request with a bunch of queries to pull customer info. Since the server had zero limits, I walked away with a ton of sensitive data in one go—stuff that should’ve been locked down tight!
Penetration Testing: How to Spot and Exploit Batching Attacks

If you’re a pentester and want to hunt for this vulnerability, here’s your game plan:

Find GraphQL Endpoints

Use tools like GraphQL Voyager or Burp Suite to scope out the API endpoints.
Check if the server supports batching (usually by sending an array of queries in a POST request).

Sample Payload to Detect Batching Support

To test if the server supports batching, you can send a simple request like this:
json
[ {"query": "query { user(id: \"1\") { name } }"}, {"query": "query { user(id: \"2\") { name } }"} ]

This sends two basic queries to see how the server responds.

Test Batching Limits

Send a batch request with a ton of queries (like 100 or 1,000) and see how the server reacts.
Tools like Postman or graphql-client are your best friends for crafting these requests.
If the server lags or throws an error, it might not have proper limits in place.

Sample Payload for Testing Limits

To check if the server has limits, send a request with a bunch of queries, like this:
json [ {"query": "query { user(id: \"1\") { name } }"}, {"query": "query { user(id: \"2\") { name } }"}, {"query": "query { user(id: \"3\") { name } }"}, // ... keep going up to 100 or 1,000 queries! ]

If the server processes all of them and slows down, it probably doesn’t have proper limits.

Test for Overfetching

Write queries that ask for sensitive stuff (like user data or hidden fields).
See if the server hands over data it shouldn’t.

Sample Query for Overfetching

Let’s say the API is supposed to return only a user’s name and email. Send a query like this to see what it leaks:
graphql query { user(id: "1") { name email password # This shouldn’t be returned! creditCard # This shouldn’t be returned either! } }
If the server returns sensitive fields like password or creditCard, you’ve got an Overfetching issue!

Bypassing Authentication

Send a batch request with a mix of legit and shady queries. Check if the server processes everything without a fuss.

Sample Payload for Bypassing Authentication

Imagine there’s a query only admins should access. Send a batch request like this:
json [ {"query": "query { user(id: \"1\") { name } }"}, // Legit query for everyone {"query": "query { adminData { secretKey } }"} // Admin-only query ]

If the server processes the second query (even though you’re not an admin), authentication isn’t properly enforced.
Recommended Tools

Burp Suite: Perfect for intercepting and tweaking GraphQL requests.
GraphQLmap: Great for automating GraphQL pentesting.
Clairvoyance: Handy for rebuilding GraphQL schemas and sniffing out sensitive fields.

Mitigation Strategies

To keep your GraphQL APIs safe from Batching Attacks, here’s what you need to do:

Cap the Number of Queries: Set a limit—like 10 queries per batch—so attackers can’t go wild.
Tighten Up Validation: Make sure only authorized data gets sent back.
Add Rate Limiting: Use tools like Apollo Server or NGINX to keep requests in check.
Authenticate Every Query: Double-check that each query in the batch has the right permissions.
Monitor and Log: Keep an eye out for sketchy activity, like huge batch requests, and log everything.

Conclusion

GraphQL is a super cool technology that makes developers’ lives easier, but if you don’t lock it down, it can turn into a hacker’s playground! My little pentesting adventure was a wake-up call, showing me just how sneaky threats like Batching Attacks can be. With the right tools and techniques, you can spot these risks, and with some solid security practices, you can keep your APIs safe.

Got any wild GraphQL stories from your own projects? Drop them in the comments—I’d love to hear about your hacking adventures!

DEV Community: Amin Hosseini

GraphQL Batching Attacks: My Wild Ride into Modern API Vulnerabilities