Cookie Leakage Vulnerability in fastapi-proxy-lib
Summary
GHSA-7vwr-g6pm-9hc8: Cookie leakage between different users in fastapi-proxy-lib. Affects fastapi-proxy-lib versions < 0.1.0. Fixed in 0.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fastapi-proxy-lib is a Python package available on PyPI that provides proxy functionality for FastAPI applications. It allows users to create forward and reverse proxies for HTTP and WebSocket traffic. The package utilizes the httpx library for making HTTP requests. However, in version 0.0.1 of fastapi-proxy-lib, there is a vulnerability related to cookie leakage between different users.
Vulnerability Detail
The vulnerability in fastapi-proxy-lib version 0.0.1 arises from the shared usage of the httpx.AsyncClient. This client persists cookies received from the target server across different user requests. As a result, cookies intended for one user may be leaked and shared with other users. This can lead to unauthorized access, session hijacking, and other security issues.
How To Fix
Minimum fixed version
0.1.0
This is the first release that contains the fix.
pip install --upgrade "fastapi-proxy-lib==0.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to upgrade to version 0.1.0, there are some workarounds to mitigate the risk. Firstly, avoid using the ForwardHttpProxy functionality altogether. Additionally, if you are using the ReverseHttpProxy or ReverseWebSocketProxy, ensure that the target servers do not send 'set-cookie' responses. However, it is strongly advised to upgrade to the latest version of fastapi-proxy-lib to fully resolve the vulnerability.
Conclusion
The cookie leakage vulnerability in fastapi-proxy-lib version 0.0.1 can lead to unauthorized access and session hijacking. It is crucial to upgrade to version 0.1.0 or later to mitigate the risk. If you need further assistance or support in resolving this vulnerability, please contact DevNack.com.
See every vulnerability recorded for fastapi-proxy-lib →
FAQ
The vulnerability allows for cookie leakage between different users. This can result in unauthorized access, session hijacking, and other security issues.
To fix the vulnerability, upgrade to version 0.1.0 of fastapi-proxy-lib.
If you cannot upgrade to version 0.1.0, you can avoid using the ForwardHttpProxy functionality and ensure that target servers do not send 'set-cookie' responses.
Yes, the fix for this vulnerability can be found in pull request #10 on the GitHub repository of fastapi-proxy-lib.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
