Executive Summary

This vulnerability affects Starlette versions 1.0.1 and earlier on Windows systems when using StaticFiles. It is a Server-Side Request Forgery (SSRF) issue where an attacker can use a UNC path like \\attacker.com\share to trigger an outbound SMB connection. This happens because os.path.realpath initiates the connection before rejecting the path, which can expose the service account's NTLMv2 credentials. These credentials can then be captured for offline cracking or relay attacks. The vulnerability occurs even though the HTTP response is only a 404 error.

The issue affects default deployments with follow_symlink set to False, including frameworks built on Starlette such as FastAPI. POSIX systems and configurations with follow_symlink set to True are not affected. The vulnerability was fixed in Starlette version 1.1.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the exposure of the service account's NTLMv2 credentials through outbound SMB connections initiated by the vulnerable application. An attacker can capture these credentials and use them for offline cracking or relay attacks, potentially gaining unauthorized access to network resources or escalating privileges.

Since the vulnerability occurs even when the HTTP response is a 404 error, it may be difficult to detect through normal application monitoring. This can result in a stealthy compromise of credentials and subsequent attacks on the affected system or network.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Starlette to version 1.1.0 or later, where the issue is fixed.

Avoid using the vulnerable versions (1.0.1 and earlier) on Windows systems, especially if your deployment uses the default follow_symlink=False setting.

If upgrading is not immediately possible, consider restricting outbound SMB connections from the affected service to prevent NTLMv2 credential exposure.

Useful 0 Not Useful 0