FastAPI versions lower than 0.65.2
that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack.
In versions lower than 0.65.2
, FastAPI would try to read the request payload as JSON even if the content-type
header sent was not set to application/json
or a compatible JSON media type (e.g. application/geo+json
).
So, a request with a content type of text/plain
containing JSON data would be accepted and the JSON data would be extracted.
But requests with content type text/plain
are exempt from CORS preflights, for being considered Simple requests. So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.
This is fixed in FastAPI 0.65.2
.
The request data is now parsed as JSON only if the content-type
header is application/json
or another JSON compatible media type like application/geo+json
.
It’s best to upgrade to the latest FastAPI.
But still, it would be possible to add a middleware or a dependency that checks the content-type
header and aborts the request if it is not application/json
or another JSON compatible content type.
If you have any questions or comments, write to [email protected]
github.com/tiangolo/fastapi
github.com/tiangolo/fastapi/commit/fa7e3c996edf2d5482fff8f9d890ac2390dede4d
github.com/tiangolo/fastapi/security/advisories/GHSA-8h2j-cgx8-6xv7
lists.fedoraproject.org/archives/list/[email protected]/message/MATAWX25TYKNEKLDMKWNLYDB34UWTROA
nvd.nist.gov/vuln/detail/CVE-2021-32677