PT-2024-32396 · Unknown+1 · Strawberry Graphql+1

Speedy1991 · Published 2024-09-25 · Updated 2024-10-01 · CVE-2024-47082

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versions prior to 0.243.0

Description The issue concerns Strawberry GraphQL, a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support was enabled by default in all Strawberry HTTP view integrations, making them vulnerable to cross-site request forgery (CSRF) attacks if users did not explicitly enable CSRF preventing security mechanisms for their servers. The Django HTTP view integration had an exemption for Django's built-in CSRF protection by default, making all Strawberry integrations vulnerable to CSRF attacks by default.

Recommendations For versions prior to 0.243.0, update to version 0.243.0 or later to resolve the issue. As a temporary workaround, consider disabling multipart file upload support in Strawberry HTTP view integrations until a patch is applied. Restrict access to the Django HTTP view integration to minimize the risk of exploitation. Avoid relying solely on Django's built-in CSRF protection for the Django HTTP view integration.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-47082

GHSA-79GP-Q4WV-33FR

PYSEC-2024-171

Affected Products

Django

Strawberry Graphql

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47082.json · Exploit
• https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-79gp-q4wv-33fr · Vendor Advisory
• https://github.com/strawberry-graphql/strawberry/commit/37265b230e511480a9ceace492f9f6a484be1387 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-47082 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47082 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-171 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-79gp-q4wv-33fr · Vendor Advisory
• https://github.com/strawberry-graphql/strawberry · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/strawberry-graphql/PYSEC-2024-171.yaml · Note
• https://t.me/cvenotify/96750 · Telegram Post
• https://t.me/cvedetector/6358 · Telegram Post
• https://twitter.com/CVEnew/status/1839007236259021162 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1839055370410504351 · Twitter Post
• https://strawberry.rocks/docs/breaking-changes/0.243.0 · Note