Summary

Graph Explorer is an open source application that provides visualization and exploration of data in graph databases such as Amazon Neptune. An issue exists where, under certain circumstances, the server silently falls back to HTTP when HTTPS is enabled but certificates are unavailable, resulting in cleartext transmission of sensitive information.

Impact

When PROXY_SERVER_HTTPS_CONNECTION is set to true, Graph Explorer is expected to serve all traffic over HTTPS. However, certain non-default configuration combinations could prevent SSL certificates from being generated or located, causing the server to silently fall back to serving over HTTP with no warning or error. Deployments intended to be HTTPS-only could unknowingly serve traffic in cleartext.

Standard deployments using the default configuration with HOST set are unlikely to be affected, as certificate generation would succeed normally.

Patches

This issue has been addressed in Graph Explorer version 3.0.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

If you cannot upgrade immediately, please take the following actions:

• Verify your deployment is actually serving over HTTPS by checking the protocol in the browser or via curl
• Ensure HOST is set in your docker run command so certificates are generated correctly
• Avoid using non-default configuration directory paths when relying on automatic self-signed certificate generation

References

If you have any questions or comments about this advisory, we ask that you contact AWS Security via our issue reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Acknowledgement

We would like to thank Eduardo Caro for collaborating on this issue through the coordinated vulnerability disclosure process.