http/misconfiguration: add GraphiQL exposure template

[vincentayorinde]

Fixes #15614

PR Information

• Added GraphiQL exposure template
• References:
  • https://github.com/graphql/graphiql

Template validation

• Validated with a host running a vulnerable version and/or configuration (True Positive)
• Validated with a host running a patched version and/or configuration (avoid False Positive)

Additional Details (leave it blank if not applicable)

• Template path:
  • http/misconfiguration/graphql/graphql-graphiql-exposure.yaml
• Validation:
  • nuclei -validate -t http/misconfiguration/graphql/graphql-graphiql-exposure.yaml
• Checked repository before contribution:
  • Existing technology detection found at http/technologies/graphiql-detect.yaml
  • No dedicated misconfiguration / exposure template for GraphiQL was found
• Detection is low-noise and GET-only
• Matchers require:
  • HTTP 200
  • text/html content
  • GraphiQL-specific markers such as:
    • graphiql.createFetcher
    • GraphiQL
    • id="graphiql"
    • id='graphiql'

Additional References:

• Nuclei Template Creation Guideline
• Nuclei Template Matcher Guideline
• Nuclei Template Contribution Guideline
• PD-Community Discord server

[neo-by-projectdiscovery-dev]

Neo - Nuclei Template Review

Medium: 2

Highlights

• GraphiQL exposure detection with precise, low-noise matchers
• Proper content-type validation (text/html) prevents false positives on JSON/XML endpoints
• Three specific GraphiQL indicators combined with AND logic: graphiql.createFetcher, id="graphiql", id='graphiql'
• Follows same pattern as similar templates (graphql-voyager, apollo-sandbox) with severity: low

Medium (2)

• Removed Content-Type Check Reduces Detection Accuracy — http/misconfiguration/graphql/graphiql-exposure.yaml:43
  The previous approved version (ffaefae) included a text/html content-type check to ensure only HTML responses match. This commit removes that check, which could cause false positives on JSON error responses or documentation that mention GraphiQL patterns.
• Removed text/html Content-Type Check Increases False Positive Risk — http/misconfiguration/graphql/graphiql-exposure.yaml:33
  The approved version (commit ffaefae) included a content-type matcher checking for 'text/html' in the response headers (lines 40-43 of the old file). This critical matcher was removed in the current commit. Without this check, the template will match non-HTML responses such as JSON error messages, application logs, or API responses that happen to contain GraphiQL-related strings.

Suggested Fixes

Removed Content-Type Check Reduces Detection Accuracy (http/misconfiguration/graphql/graphiql-exposure.yaml:43):

Re-add the text/html content-type matcher that was present in the approved version (lines 40-43 of graphql-graphiql-exposure.yaml at commit ffaefae). This ensures only HTML pages are matched, consistent with graphql-playground.yaml which also checks for text/html.

Removed text/html Content-Type Check Increases False Positive Risk (http/misconfiguration/graphql/graphiql-exposure.yaml:33):

Restore the content-type matcher that was present in the approved commit ffaefae:

- type: word
  part: header
  words:
    - "text/html"

This should be added between the body word matcher and the status matcher to ensure only HTML responses are matched.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

Verify each finding against the current code and only fix it if needed.

In @http/misconfiguration/graphql/graphiql-exposure.yaml after line 39 (after
the body word matcher), re-add the content-type check that was removed: add a
word matcher for part: header, words: ['text/html'] to ensure only HTML
responses trigger detection and avoid false positives on JSON/text responses
mentioning GraphiQL.

Verify each finding against the current code and only fix it if needed.

In @http/misconfiguration/graphql/graphiql-exposure.yaml at line 31 (matchers
section), add back the content-type check that was removed from the approved
version. After the body word matcher (lines 32-39) and before the status matcher
(lines 41-43), insert a new word matcher:

  - type: word
    part: header
    words:
      - "text/html"

This ensures the template only matches HTML responses, preventing false
positives on JSON errors, logs, or other non-HTML content containing GraphiQL
strings.

Hardening Notes

• Consider adding /console/graphiql and /admin/graphiql as additional common paths based on real-world deployments

_{Comment @pdneo help for available commands. · Open in Neo}

[neo-by-projectdiscovery-dev]

🟡 Removed Content-Type Check Reduces Detection Accuracy — The previous approved version (ffaefae) included a text/html content-type check to ensure only HTML responses match. This commit removes that check, which could cause false positives on JSON error responses or documentation that mention GraphiQL patterns.

Suggested Fix

Re-add the text/html content-type matcher that was present in the approved version (lines 40-43 of graphql-graphiql-exposure.yaml at commit ffaefae). This ensures only HTML pages are matched, consistent with graphql-playground.yaml which also checks for text/html.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@http/misconfiguration/graphql/graphiql-exposure.yaml` after line 39 (after
the body word matcher), re-add the content-type check that was removed: add a
word matcher for part: header, words: ['text/html'] to ensure only HTML
responses trigger detection and avoid false positives on JSON/text responses
mentioning GraphiQL.

[neo-by-projectdiscovery-dev]

🟡 Removed text/html Content-Type Check Increases False Positive Risk — The approved version (commit ffaefae) included a content-type matcher checking for 'text/html' in the response headers (lines 40-43 of the old file). This critical matcher was removed in the current commit. Without this check, the template will match non-HTML responses such as JSON error messages, application logs, or API responses that happen to contain GraphiQL-related strings.

Suggested Fix

Restore the content-type matcher that was present in the approved commit ffaefae:

- type: word
  part: header
  words:
    - "text/html"

This should be added between the body word matcher and the status matcher to ensure only HTML responses are matched.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@http/misconfiguration/graphql/graphiql-exposure.yaml` at line 31 (matchers
section), add back the content-type check that was removed from the approved
version. After the body word matcher (lines 32-39) and before the status matcher
(lines 41-43), insert a new word matcher:

      - type: word
        part: header
        words:
          - "text/html"

This ensures the template only matches HTML responses, preventing false
positives on JSON errors, logs, or other non-HTML content containing GraphiQL
strings.