Unauthorized Access Risk in FastAPI Middleware: CVE-2024-40627
Summary
UBUNTU-CVE-2024-40627: Fastapi OPA is an opensource fastapi middleware which includes auth flow. Affects fastapi versions 0.63.0-2 – 0.63.0-2ubuntu0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FastAPI is a modern, fast (high-performance) web framework for building APIs with Python 3.6+ based on standard Python type hints. It is designed to create web applications quickly and efficiently, with features like automatic interactive API documentation. However, a vulnerability has been identified in its middleware, OpaMiddleware, which can lead to unauthorized access under certain conditions.
Vulnerability Detail
The vulnerability arises from the OpaMiddleware's handling of HTTP OPTIONS requests. It allows these requests to pass through without authentication checks, potentially exposing sensitive information about the application's entities. An unauthenticated attacker could exploit this flaw to determine the existence of certain entities, which could lead to further attacks or data breaches. This issue has been classified with a CVSS score of 5.8, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. It is strongly recommended to upgrade to the patched version as soon as possible to mitigate the risk.
Conclusion
The CVE-2024-40627 vulnerability in FastAPI's OpaMiddleware poses a significant risk by allowing unauthorized access to HTTP OPTIONS requests. Users are strongly advised to upgrade to the patched version to secure their applications against potential exploitation.
See every vulnerability recorded for fastapi →
FAQ
CVE-2024-40627 is a vulnerability in FastAPI's OpaMiddleware that allows unauthorized HTTP OPTIONS requests, potentially exposing sensitive application information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
While there are no workarounds available, it is crucial to prioritize upgrading to the patched version to ensure your application's security.
An attacker could exploit this vulnerability to discover existing entities in your application, which could lead to further attacks or data breaches.
While the vulnerability itself does not directly cause data loss, it can expose sensitive information that may lead to more severe security incidents.
Related vulnerabilities
Recent vulnerabilities recorded for fastapi.
