GHSA-8h2j-cgx8-6xv7 Cross-Site Request Forgery (CSRF) in FastAPI

• PyPI fastapi: < 0.65.2 → fixed in 0.65.2

Impact FastAPI versions lower than `0.65.2` that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than `0.65.2`, FastAPI would try to read the request payload as JSON even if the `content-type` header sent was not set to `application/json` or a compatible JSON media type (e.g. `application/geo+json`). So, a request with a content type of `text/plain` containing JSON data would be accepted and the JSON data would be extracted. But requests with content type `text/plain` are exempt from CORS preflights, for being considered Simple requests. So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. Patches This is fixed in FastAPI `0.65.2`. The request data is now parsed as JSON only if the `content-type` header is `application/json` or another JSON compatible media type like `application/geo+json`. Workarounds It's best to upgrade to the latest FastAPI. But still, it would be possible to add a middleware or a dependency that checks the `content-type` header and aborts the request if it is not `application/json` or another JSON compatible content type. References • CORS on Mozilla web docs • This answer on StackExchange • OWASP CSRF • Fixed in PR #2118 For more information If you have any questions or comments, write to [email protected]