GHSA-8h2j-cgx8-6xv7

Suggest an improvement
Source
https://github.com/advisories/GHSA-8h2j-cgx8-6xv7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-8h2j-cgx8-6xv7/GHSA-8h2j-cgx8-6xv7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8h2j-cgx8-6xv7
Aliases
Related
Published
2021-06-10T15:43:54Z
Modified
2024-09-20T17:27:45.811394Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CVSS Calculator
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Cross-Site Request Forgery (CSRF) in FastAPI
Details

Impact

FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack.

In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json).

So, a request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted.

But requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.

Patches

This is fixed in FastAPI 0.65.2.

The request data is now parsed as JSON only if the content-type header is application/json or another JSON compatible media type like application/geo+json.

Workarounds

It's best to upgrade to the latest FastAPI.

But still, it would be possible to add a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type.

References

For more information

If you have any questions or comments, write to security@tiangolo.com

Database specific 
{
    "nvd_published_at": "2021-06-09T18:15:00Z",
    "cwe_ids": [
        "CWE-352"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-06-09T13:34:54Z"
}
References

Affected packages

PyPI / fastapi

Package

Name
fastapi
View open source insights on deps.dev
Purl
pkg:pypi/fastapi

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.65.2

Affected versions

0.*

0.1.0
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.1.17
0.1.18
0.1.19
0.2.0
0.2.1
0.3.0
0.4.0
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.7.0
0.7.1
0.8.0
0.9.0
0.9.1
0.10.0
0.10.1
0.10.2
0.11.0
0.12.0
0.12.1
0.13.0
0.14.0
0.15.0
0.16.0
0.17.0
0.18.0
0.19.0
0.20.0
0.20.1
0.21.0
0.22.0
0.23.0
0.24.0
0.25.0
0.26.0
0.27.0
0.27.1
0.27.2
0.28.0
0.29.0
0.29.1
0.30.0
0.30.1
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.38.0
0.38.1
0.39.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.44.1
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.49.1
0.49.2
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.53.2
0.54.0
0.54.1
0.54.2
0.55.0
0.55.1
0.56.0
0.56.1
0.57.0
0.58.0
0.58.1
0.59.0
0.60.0
0.60.1
0.60.2
0.61.0
0.61.1
0.61.2
0.62.0
0.63.0
0.64.0
0.65.0
0.65.1