Executive Summary

This vulnerability exists in Starlette versions 1.0.1 and below. When dispatching a request, the HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute without restricting the lookup to a known set of HTTP verbs.

If an HTTPEndpoint subclass is registered through Route(...) without explicitly specifying allowed HTTP methods, the route does not constrain the method, allowing every method to reach the endpoint.

An attacker can send a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass. This causes that attribute to be invoked as if it were a request handler, potentially reaching internal methods that were never meant to be HTTP handlers.

These internal methods may lack authorization checks, allowing unauthorized access to functionality.

The issue is fixed in Starlette version 1.1.0.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Starlette to version 1.1.0 or later where the issue is fixed.

Additionally, ensure that when registering an HTTPEndpoint subclass via Route(...), you explicitly set the methods= argument to restrict allowed HTTP methods.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to invoke internal methods of an application that were not intended to be exposed as HTTP handlers.

Since these internal methods may not have proper authorization checks, an attacker could bypass security controls and perform unauthorized actions.

This could lead to information disclosure, unauthorized operations, or other security impacts depending on what the internal methods do.

Useful 0 Not Useful 0