PT-2024-28950 · Unknown · Fastapi Opa

Miceg · Published 2024-07-15 · Updated 2024-07-16 · CVE-2024-40627

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Fastapi OPA versions prior to 2.0.1

Description The issue allows unauthenticated attackers to discover which entities exist within an application by sending HTTP OPTIONS requests. This is because OpaMiddleware allows all HTTP OPTIONS requests without evaluating them against any policy. If an application provides different responses to HTTP OPTIONS requests based on an entity existing, an attacker could exploit this to gain information about the application's internal state.

Recommendations For versions prior to 2.0.1, upgrade to release version 2.0.1 to address the issue. As a temporary workaround, consider restricting access to the read item options function or modifying the application to not provide different responses to HTTP OPTIONS requests based on entity existence. Avoid using the Allow header in the read item options function to indicate entity writability until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2024-40627

GHSA-5F5C-8RVC-J8WF

Affected Products

Fastapi Opa

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40627.json · Exploit
• https://cve.org/CVERecord?id=CVE-2024-40627 · Security Note
• https://osv.dev/vulnerability/GHSA-5f5c-8rvc-j8wf · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-40627 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40627 · Security Note
• https://ubuntu.com/security/CVE-2024-40627 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-40627 · Vendor Advisory
• https://github.com/busykoala/fastapi-opa/commit/9588109ff651f7ffc92687129c4956126443fb8c · Note
• https://github.com/busykoala/fastapi-opa/blob/6dd6f8c87e908fe080784a74707f016f1422b58a/fastapi_opa/opa/opa_middleware.py#L79-L80 · Note
• https://github.com/busykoala/fastapi-opa/security/advisories/GHSA-5f5c-8rvc-j8wf · Note
• https://github.com/busykoala/fastapi-opa/commit/9458845a6f6f414c0b79587fae83d7f14d74dfb4 · Note
• https://github.com/busykoala/fastapi-opa · Note
• https://t.me/cvedetector/900 · Telegram Post