PT-2021-4289 · Fastapi+1 · Fastapi+1

Dima Boger · Published 2021-06-02 · Updated 2024-02-12 · CVE-2021-32677

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FastAPI versions prior to 0.65.2

Description The issue is related to a Cross-Site Request Forgery (CSRF) attack in FastAPI, a web framework for building APIs with Python. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type. This allowed a request with a content type of text/plain containing JSON data to be accepted and the JSON data to be extracted. The browser would execute such requests right away, including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.

Recommendations To resolve the issue, upgrade to the latest FastAPI version. If updating is not possible, consider adding a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2021-04898

CVE-2021-32677

GHSA-8H2J-CGX8-6XV7

PYSEC-2021-100

Affected Products

Debian

Fastapi

References · 18

• https://github.com/tiangolo/fastapi/commit/fa7e3c996edf2d5482fff8f9d890ac2390dede4d · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MATAWX25TYKNEKLDMKWNLYDB34UWTROA · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32677 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-32677 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MATAWX25TYKNEKLDMKWNLYDB34UWTROA · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32677 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32677 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-100 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8h2j-cgx8-6xv7 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-32677 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32677 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32677 · Security Note
• https://bdu.fstec.ru/vul/2021-04898 · Security Note
• https://github.com/tiangolo/fastapi/security/advisories/GHSA-8h2j-cgx8-6xv7 · Note
• https://github.com/tiangolo/fastapi · Note