GHSA-7vwr-g6pm-9hc8 Cookie leakage between different users in fastapi-proxy-lib

Not scored Published 1 Dec 2023

An attacker can steal session cookies from other users due to shared HTTP client state in the proxy library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-7vwr-g6pm-9hc8?

GHSA-7vwr-g6pm-9hc8 is a vulnerability in fastapi-proxy-lib, published on 1 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Impact

In the implementation of version 0.0.1, requests from different user clients are processed using a shared httpx.AsyncClient.

However, one oversight is that the httpx.AsyncClient will persistently store cookies based on the set-cookie response header sent by the target server and share these cookies across different user requests.

This results in a cookie leakage issue among all user clients sharing the same httpx.AsyncClient.

Patches

It's fixed in 0.1.0

Workarounds

If you insist 0.0.1:

Do not use ForwardHttpProxy at all.
Do not use ReverseHttpProxy or ReverseWebSocketProxy for any servers that may potentially send a set-cookie response.

However, it's best to upgrade to the latest version.

References

fixed in #10

Which versions are affected by GHSA-7vwr-g6pm-9hc8?

2 open source packages ship an affected version, including fastapi-proxy-lib.

Package	Affected	Fixed in
`fastapi-proxy-lib` PyPI	All versions	`0.1.0`
`fastapi-proxy-lib` PyPI	All versions	`0.1.0`

How do I fix GHSA-7vwr-g6pm-9hc8?

Upgrade fastapi-proxy-lib to 0.1.0 or later.

Is GHSA-7vwr-g6pm-9hc8 being exploited?

There is no known exploitation of GHSA-7vwr-g6pm-9hc8 in the wild and no public exploit code.