PT-2020-19881 · Marshmallow · Webargs

Published 2020-01-29 · Updated 2021-04-07 · CVE-2020-7965

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Webargs versions 5.x through 5.5.2

Description The issue arises from the failure to verify the Content-Type header as application/json when receiving JSON input. This allows the software to accept valid JSON requests even if the content type is specified as application/x-www-form-urlencoded, enabling JSON POST requests to be made across domains and leading to Cross-Site Request Forgery (CSRF) attacks.

Recommendations For versions 5.x through 5.5.2, consider updating to a version that includes a fix for this issue, as the current version does not properly validate the Content-Type header for JSON input. As a temporary workaround, consider restricting access to JSON endpoints to minimize the risk of CSRF attacks until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-7965

GHSA-FJQ3-5PXW-4WJ4

PYSEC-2020-156

Affected Products

Webargs

References · 12

• https://osv.dev/vulnerability/PYSEC-2020-156 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fjq3-5pxw-4wj4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7965 · Security Note
• https://webargs.readthedocs.io/en/latest/changelog.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7965 · Vendor Advisory
• https://github.com/marshmallow-code/webargs · Note
• https://github.com/marshmallow-code/webargs/commit/b9ee8b0aa668207a363d9fd21d967eeadb975c3e · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/webargs/PYSEC-2020-156.yaml · Note
• https://webargs.readthedocs.io/en/latest/changelog.html#id11 · Note
• https://github.com/advisories/GHSA-fjq3-5pxw-4wj4 · Note
• https://webargs.readthedocs.io/en/latest/changelog.html#b4-2020-01-28 · Note
• https://t.me/cvenotify/590 · Telegram Post