REDHAT-BUG-2490020: SSRF
Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default followsymlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and followsymlink=True are unaffected. The issue is fixed in 1.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Starletteto a version that resolves this vulnerability.Fixed in 1.1.0 - Upgrade
Upgrade
StaticFiles on Windowsto a version that resolves this vulnerability.Fixed in 1.1.0 - Configuration
Ensure the default follow_symlink=False deployment setting is used; the issue affects default follow_symlink=False deployments (POSIX systems and follow_symlink=True are unaffected).
Starlette/Frameworks built on Starlette (e.g., FastAPI) follow_symlink = false
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2490020?
The severity of REDHAT-BUG-2490020 is classified as high with a CVSS score of 7.
How do I fix REDHAT-BUG-2490020?
To fix REDHAT-BUG-2490020, upgrade to Starlette version 1.0.2 or later where the vulnerability has been addressed.
What type of vulnerability is represented by REDHAT-BUG-2490020?
REDHAT-BUG-2490020 represents an SSRF (Server-Side Request Forgery) vulnerability.
Which versions of Starlette are affected by REDHAT-BUG-2490020?
Starlette versions 1.0.1 and earlier are affected by REDHAT-BUG-2490020.
What could be exposed due to the vulnerability in REDHAT-BUG-2490020?
The vulnerability in REDHAT-BUG-2490020 could expose the service account's NTLM credentials due to an outbound SMB connection.