| Severity |
|
| Remote |
|
| Type |
| - |
Unknown |
| + |
Cross-site request forgery |
|
| Description |
| + |
FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. |
| + |
|
| + |
In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). |
| + |
|
| + |
So, a request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. |
| + |
|
| + |
But requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. |
|
| References |
| + |
https://github.com/tiangolo/fastapi/security/advisories/GHSA-8h2j-cgx8-6xv7 |
| + |
https://github.com/tiangolo/fastapi/pull/2118 |
| + |
https://github.com/tiangolo/fastapi/commit/fa7e3c996edf2d5482fff8f9d890ac2390dede4d |
|
| Notes |
| + |
Workaround |
| + |
========== |
| + |
|
| + |
To mitigate the issue, it would be possible to add a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type. |
|