CVE-2024-24762

`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4
https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p
https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74
https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5
https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238
https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc	Patch
https://github.com/tiangolo/fastapi/releases/tag/0.109.1	Product
https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:tiangolo:fastapi:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-02-05 15:15

Updated : 2024-02-17 02:15

NVD link : CVE-2024-24762

Mitre link : CVE-2024-24762

CVE.ORG link : CVE-2024-24762

JSON object : View

Products Affected

tiangolo

fastapi

CWE

CWE-1333

Inefficient Regular Expression Complexity

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2024-24762", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-02-05T15:15:09.260", "references": [{"url": "https://github.com/Kludex/python-multipart/commit/20f0ef6b4e4caf7d69a667c54dff57fe467109a4", "source": "security-advisories@github.com"}, {"url": "https://github.com/Kludex/python-multipart/security/advisories/GHSA-2jv5-9r88-3w3p", "source": "security-advisories@github.com"}, {"url": "https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74", "source": "security-advisories@github.com"}, {"url": "https://github.com/encode/starlette/commit/13e5c26a27f4903924624736abd6131b2da80cc5", "source": "security-advisories@github.com"}, {"url": "https://github.com/encode/starlette/security/advisories/GHSA-93gm-qmq6-w238", "source": "security-advisories@github.com"}, {"url": "https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/tiangolo/fastapi/releases/tag/0.109.1", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1333"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7."}, {"lang": "es", "value": "FastAPI es un framework web para crear API con Python 3.8+ basado en sugerencias de tipo est\u00e1ndar de Python. Cuando se utilizan datos de formulario, `python-multipart` usa una expresi\u00f3n regular para analizar el encabezado HTTP `Content-Type`, incluidas las opciones. Un atacante podr\u00eda enviar una opci\u00f3n de \"Tipo de contenido\" personalizada que es muy dif\u00edcil de procesar para RegEx, consumiendo recursos de CPU y deteni\u00e9ndose indefinidamente (minutos o m\u00e1s) mientras se mantiene el bucle de evento principal. Esto significa que el proceso no puede manejar m\u00e1s solicitudes. Es un ReDoS (expresi\u00f3n regular de denegaci\u00f3n de servicio), solo se aplica a aquellos que leen datos del formulario usando `python-multipart`. Esta vulnerabilidad ha sido parcheada en la versi\u00f3n 0.109.0."}], "lastModified": "2024-02-17T02:15:52.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tiangolo:fastapi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B47D84E-D97C-4E52-91AE-270FCFA34800", "versionEndExcluding": "0.109.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}