CVE-2021-32677 Cross-Site Request Forgery (CSRF) in FastAPI

What is CVE-2021-32677?

CVE-2021-32677 is a high-severity vulnerability in Fedoraproject Fedora, published on 9 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FastAPI is a web framework for building APIs with Python 3.6+ based on standard Python type hints. FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. This is fixed in FastAPI 0.65.2. The request data is now parsed as JSON only if the content-type header is application/json or another JSON compatible media type like application/geo+json. It's best to upgrade to the latest FastAPI, but if updating is not possible then a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type can act as a mitigating workaround.

Weakness: CWE-352

Which versions are affected by CVE-2021-32677?

3 open source packages ship an affected version, including fastapi. It affects 2 products.

Products include Fedoraproject Fedora, Tiangolo Fastapi.

How do I fix CVE-2021-32677?

Upgrade fastapi to 0.65.2 or later.

Is CVE-2021-32677 being exploited?

There is no known exploitation of CVE-2021-32677 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2024-4577 PHP-CGI OS Command Injection Exploited Critical 9.8
• CVE-2021-39226 Grafana Authentication Bypass Exploited Critical 9.8
• CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Exploited Critical 9.8
• CVE-2024-4947 Google Chromium V8 Type Confusion Exploited Critical 9.6
• CVE-2024-4671 Google Chromium Visuals Use-After-Free Exploited Critical 9.6

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2025-1754957513, DEBIAN-CVE-2021-32677, GHSA-8h2j-cgx8-6xv7, PYSEC-2021-100, UBUNTU-CVE-2021-32677.