Vulnerability · Published Sep 25, 2024 · Assigned by GitHub_M
CVE-2024-47082Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability
Medium 4.6
In plain English
A medium-severity cross-site request forgery in strawberry from strawberry-graphql. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawberry HTTP view integrations vulnerable to cross-site request forgery (CSRF) attacks if users did not explicitly enable CSRF preventing security mechanism for their servers. Additionally, the Django HTTP view integration, in particular, had an exemption for Django's built-in CSRF protection (i.e., the `CsrfViewMiddleware` middleware) by default. In affect, all Strawberry integrations were vulnerable to CSRF attacks by default. Version `v0.243.0` is the first `strawberry-graphql` including a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | strawberry-graphql | 0.243.0 | GHSA-79gp-q4wv-33fr |
| PyPI | strawberry-graphql | 0.243.0 | PYSEC-2024-171 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| strawberry-graphql | strawberry | < 0.243.0 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L