CVE-2021-32677 – fastapi

Package

Manager: pip
Name: fastapi
Vulnerable Version: >=0 <0.65.2

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00119 pctl0.31504

Details

Cross-Site Request Forgery (CSRF) in FastAPI ### Impact FastAPI versions lower than `0.65.2` that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than `0.65.2`, FastAPI would try to read the request payload as JSON even if the `content-type` header sent was not set to `application/json` or a compatible JSON media type (e.g. `application/geo+json`). So, a request with a content type of `text/plain` containing JSON data would be accepted and the JSON data would be extracted. But requests with content type `text/plain` are exempt from [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) preflights, for being considered [Simple requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests). So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. ### Patches This is fixed in FastAPI `0.65.2`. The request data is now parsed as JSON only if the `content-type` header is `application/json` or another JSON compatible media type like `application/geo+json`. ### Workarounds It's best to upgrade to the latest FastAPI. But still, it would be possible to add a middleware or a dependency that checks the `content-type` header and aborts the request if it is not `application/json` or another JSON compatible content type. ### References * [CORS on Mozilla web docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) * [This answer on StackExchange](https://security.stackexchange.com/questions/157528/ways-to-bypass-browsers-cors-policy/157531#157531) * [OWASP CSRF](https://owasp.org/www-community/attacks/csrf) * Fixed in PR [#2118](https://github.com/tiangolo/fastapi/pull/2118) ### For more information If you have any questions or comments, write to [security@tiangolo.com](mailto:security@tiangolo.com)

Metadata

Created: 2021-06-10T15:43:54Z
Modified: 2024-09-20T17:18:26Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-8h2j-cgx8-6xv7/GHSA-8h2j-cgx8-6xv7.json
CWE IDs: ["CWE-352"]
Alternative ID: GHSA-8h2j-cgx8-6xv7
Finding: F007
Auto approve: 1