SHADOWCORE_
Back to Case Studies
Pentest Application Security

Composite GraphQL Exposure and a Dev-to-Prod Trust Bridge Behind an Otherwise Solid CMS Platform

Chained several individually-minor GraphQL exposures into a single High-severity finding, then found the client's own code trusted their internet-exposed development environment as a data source — a bridge from a lower-security environment straight into production.

Client: Content-Driven Web Platform Operator — Headless CMS Architecture

Industry
Digital Media / Content Platform
Engagement
Grey-box penetration test · Production web application, admin backend, and codebase review
9
Total findings
0
Critical findings
High (composite)
Highest severity

Challenge

The client runs a content platform on a headless CMS architecture, with a separate front-end application and admin backend. They wanted proof of exploitability, not just a vulnerability list — confirmation of what an attacker could actually extract or manipulate, and clear guidance on fixing it.

Approach

A grey-box assessment combining automated web and dependency scanning with manual verification and source-code review, since the pre-defined scope meant reconnaissance could focus on understanding application logic rather than discovering endpoints. Every automated finding was manually re-checked before being reported — several scanner hits were confirmed as false positives and dropped rather than padding the finding count.

Key Activities

  • ▸ Manually verified every automated scan result against the live application to eliminate false positives before reporting
  • ▸ Queried the unauthenticated GraphQL endpoint directly to confirm real extraction of user identifiers and internal application structure, not just endpoint discoverability
  • ▸ Tested the legacy XML-RPC interface for authentication-lockout bypass via its multicall method
  • ▸ Reviewed the codebase for trust relationships between the production and development environments
  • ▸ Ran static analysis and dependency scanning, manually triaging every hit rather than reporting scanner output as-is
  • ▸ Delivered severity ratings built from how findings combine, not just individual scanner scores

Results

✓ Chained an unauthenticated GraphQL endpoint with verbose error messages and unrestricted queries into a single High-severity finding — individually minor issues that composed into real data exposure
✓ Confirmed unauthorized GraphQL queries could extract usernames, emails, and internal database identifiers usable in follow-on write operations
✓ Found the legacy XML-RPC interface exposed a method that bypassed the application's own login-lockout protection entirely
✓ Discovered the client's own production code explicitly trusted their internet-exposed, unauthenticated development environment as a file source — a direct bridge from a lower-security environment into production
✓ Delivered a full finding set with no fabricated criticals — the platform's actual security posture was rated good, with the composite GraphQL issue as the one real priority

Business Impact

★ Gave the client an honest, evidence-based security rating instead of an inflated finding count — credibility that matters when a report says 'this is fine' as often as it says 'fix this'
★ Surfaced an architecture-level trust bridge between environments that neither a pure code review nor a pure external pentest alone would have caught — it took both together
★ Delivered fixes the client's team could prioritize correctly: one real composite risk to close first, a short list of hardening items after

Technologies & Service Areas

Web Application Testing Source Code Review API Security CMS Security

Related Services

Penetration Testing → Cloud Security Audit →

Client names and identifying details are withheld. This case study is a sanitized account shared with the client's consent.