StaticFiles SSRF Vulnerability in Starlette on Windows

Compliance Impact

This vulnerability allows an attacker to cause the service to initiate an outbound SMB connection, potentially exposing the service account’s NTLMv2 credentials for offline cracking or relay attacks. Such credential exposure could lead to unauthorized access to sensitive data.

Exposure of credentials and potential unauthorized access could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data and mandate controls to prevent unauthorized access.

However, the provided information does not explicitly discuss compliance impacts or specific regulatory considerations.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects Starlette versions 1.0.1 and earlier on Windows systems when using StaticFiles. It is a Server-Side Request Forgery (SSRF) issue where an attacker can use a UNC path like \\attacker.com\share to trigger an outbound SMB connection. This happens because os.path.realpath initiates the connection before rejecting the path, which can expose the service account's NTLMv2 credentials. These credentials can then be captured for offline cracking or relay attacks. The vulnerability occurs even though the HTTP response is only a 404 error.

The issue affects default deployments with follow_symlink set to False, including frameworks built on Starlette such as FastAPI. POSIX systems and configurations with follow_symlink set to True are not affected. The vulnerability was fixed in Starlette version 1.1.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the exposure of the service account's NTLMv2 credentials through outbound SMB connections initiated by the vulnerable application. An attacker can capture these credentials and use them for offline cracking or relay attacks, potentially gaining unauthorized access to network resources or escalating privileges.

Since the vulnerability occurs even when the HTTP response is a 404 error, it may be difficult to detect through normal application monitoring. This can result in a stealthy compromise of credentials and subsequent attacks on the affected system or network.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Starlette to version 1.1.0 or later, where the issue is fixed.

Avoid using the vulnerable versions (1.0.1 and earlier) on Windows systems, especially if your deployment uses the default follow_symlink=False setting.

If upgrading is not immediately possible, consider restricting outbound SMB connections from the affected service to prevent NTLMv2 credential exposure.

Useful 0 Not Useful 0