CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
EPSS
Percentile
37.6%
FastAPI is a web framework for building APIs with Python 3.6+ based on
standard Python type hints. FastAPI versions lower than 0.65.2 that used
cookies for authentication in path operations that received JSON payloads
sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF)
attack. In versions lower than 0.65.2, FastAPI would try to read the
request payload as JSON even if the content-type header sent was not set to
application/json or a compatible JSON media type (e.g.
application/geo+json). A request with a content type of text/plain
containing JSON data would be accepted and the JSON data would be
extracted. Requests with content type text/plain are exempt from CORS
preflights, for being considered Simple requests. The browser will execute
them right away including cookies, and the text content could be a JSON
string that would be parsed and accepted by the FastAPI application. This
is fixed in FastAPI 0.65.2. The request data is now parsed as JSON only if
the content-type header is application/json or another JSON compatible
media type like application/geo+json. It’s best to upgrade to the latest
FastAPI, but if updating is not possible then a middleware or a dependency
that checks the content-type header and aborts the request if it is not
application/json or another JSON compatible content type can act as a
mitigating workaround.
github.com/tiangolo/fastapi/commit/fa7e3c996edf2d5482fff8f9d890ac2390dede4d (0.65.2)
github.com/tiangolo/fastapi/security/advisories/GHSA-8h2j-cgx8-6xv7
launchpad.net/bugs/cve/CVE-2021-32677
nvd.nist.gov/vuln/detail/CVE-2021-32677
security-tracker.debian.org/tracker/CVE-2021-32677
www.cve.org/CVERecord?id=CVE-2021-32677
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
EPSS
Percentile
37.6%