Fastapi · Fastapi · CVE-2021-32677
**Name of the Vulnerable Software and Affected Versions**
FastAPI versions prior to 0.65.2
**Description**
The issue is related to a Cross-Site Request Forgery (CSRF) attack in FastAPI, a web framework for building APIs with Python. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type. This allowed a request with a content type of text/plain containing JSON data to be accepted and the JSON data to be extracted. The browser would execute such requests right away, including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.
**Recommendations**
To resolve the issue, upgrade to the latest FastAPI version.
If updating is not possible, consider adding a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type.