starlette@0.3.6

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') when dispatching HTTP requests to endpoint attributes via getattr. An attacker can invoke internal methods not intended as HTTP handlers by sending requests with non-standard HTTP methods whose names match internal attribute names, potentially bypassing authorization checks.

Note: This is only exploitable if an HTTPEndpoint subclass is registered through Route(...) without specifying the methods= argument and the subclass defines additional methods matching non-standard HTTP-method token shapes that accept a single request argument and return a response.

Upgrade starlette to version 1.1.0 or higher.

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the StaticFiles file on Windows systems when handling UNC paths. An attacker can obtain NTLMv2 credentials of the service account by sending a specially crafted request that causes the server to initiate an outbound SMB connection to an attacker-controlled host, resulting in credential disclosure.

Note: This is only exploitable if the application is running on Windows and serving static files using the default configuration (follow_symlink=False).

Upgrade starlette to version 1.1.0 or higher.

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to HTTP Request Smuggling via the request.url reconstruction process. An attacker can bypass path-based security checks by supplying a malformed Host header that causes request.url.path to differ from the actual requested path.

Note:

This is only exploitable if the application relies on request.url (or request.url.path) for security-sensitive decisions. The most common case is middleware that gates access to certain path prefixes based on request.url.path. Deployments fronted by a proxy or load balancer are mitigated only if that proxy rejects or normalizes the malformed Host header before forwarding and the application does not trust attacker-controlled host headers (e.g. X-Forwarded-Host) elsewhere.

Upgrade starlette to version 1.0.1 or higher.

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the FileResponse._parse_range_header method. An attacker can exhaust server CPU resources by sending a specially crafted HTTP Range header containing numerous small, non-overlapping ranges, which triggers quadratic-time processing during range parsing and merging.

Upgrade starlette to version 0.49.1 or higher.

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the UploadFile.write method when handling multipart forms containing files larger than the default spool_max_size. An attacker can cause the application to block the main event thread by submitting a multipart form with a large file, preventing the application from accepting new connections.

Upgrade starlette to version 0.47.2 or higher.

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via multipart/form-data requests, due to treating parts without a filename as text form fields and buffering those in byte strings with no size limit.

An attacker could cause Starlette to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt by uploading arbitrary large form fields.

Note:

This vulnerability affects all applications built with Starlette (or FastAPI) accepting form requests.

Upgrade starlette to version 0.40.0 or higher.

starlette is a The little ASGI library that shines.

Affected versions of this package are vulnerable to Denial of Service (DoS) via the MultipartParser class, which accepts an unlimited number of fields and files when parsing multipart/form-data. Exploiting this vulnerability is possible by sending too many small form fields with no content or too many empty files, which results in high CPU usage and high memory usage.

Note:

An affected application has to have all the following:

1. python-multipart installed.

2. calls request.form().

Upgrade starlette to version 0.25.0 or higher.