Описание
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on request.url (rather than the raw scope path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the Host header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing request.url and falls back to scope["server"] for malformed values.
A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP Host request header. This malformed header could cause the request.url to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on request.url for validation could be bypassed, potentially allowing unauthorized access or actions.
Отчет
The impact of this vulnerability is rated Moderate. A malformed Host header can manipulate the reconstructed request.url.path, introducing a discrepancy with the canonical ASGI request path (scope["path"]). However, the vulnerability does not directly grant access, modify routing, or bypass security controls on its own. A path-based authentication or authorization bypass is possible only if an application depends on request.url.path for access control decisions rather than the canonical ASGI path or standard framework mechanisms. The impact relies heavily on downstream application design rather than a default library failure. Red Hat Satellite / Insights (IoP): The starlette package is included as a dependency of Connexion, but this flaw is rated Low impact because these services do not use path-based authentication middleware and all services are deployed behind reverse proxies. OpenShift Lightspeed (OLS): The starlette package is included as a dependency, but this flaw is rated Low impact because authentication is enforced via Kubernetes TokenReview/SubjectAccessReview through FastAPI dependency injection, not path-based middleware; request.url.path is only used for metrics and response header application. RHOAI Kubeflow Training images: starlette is being used as indirect dependency of mlflow, but this flaw is rated as Low impact because mlflow is used as client library only to store training metrics on remote server, it doesn't expose any endpoint. RHOAI odh-automl: The impact is reduced to Low since starlette is only used in the backend and it's transient dependency and starlette is not used at all to serve any endpoints. RHOAI odh-kserve-autogluon-server-rhel9: While the Starlette dependency is present in the build, the vulnerable code in starlette is not reachable. This reduces the impact to low.
Меры по смягчению последствий
Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.
If custom middleware is present, it should be updated to use request.scope["path"] instead of request.url.path for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Will not fix | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-ocp-rag-rhel9 | Affected | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-service-api-rhel9 | Affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-cpu-rhel9 | Will not fix | ||
| Red Hat AI Inference Server | rhaiis/vllm-neuron-rhel9 | Will not fix | ||
| Red Hat AI Inference Server | rhaiis/vllm-spyre-rhel9 | Affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-tpu-rhel9 | Affected | ||
| Red Hat AI Inference Server | rhaii/vllm-cpu-rhel9 | Affected | ||
| Red Hat AI Inference Server | rhaii/vllm-gaudi-rhel9 | Will not fix | ||
| Red Hat AI Inference Server | rhaii/vllm-neuron-rhel9 | Will not fix |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1. ...
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Уязвимость компонента Request Header Handler ASGI-фреймворка для веб-разработки Starlette, позволяющая нарушителю обойти существующие ограничения безопасности
6.5 Medium
CVSS3