Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawberry HTTP view integrations vulnerable to cross-site request forgery (CSRF) attacks if users did not explicitly enable CSRF preventing security mechanism for their servers. Additionally, the Django HTTP view integration, in particular, had an exemption for Django's built-in CSRF protection (i.e., the `CsrfViewMiddleware` middleware) by default. In affect, all Strawberry integrations were vulnerable to CSRF attacks by default. Version `v0.243.0` is the first `strawberry-graphql` including a patch.
History

Tue, 01 Oct 2024 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Strawberryrocks
Strawberryrocks strawberry
CPEs cpe:2.3:a:strawberryrocks:strawberry:*:*:*:*:*:*:*:*
Vendors & Products Strawberryrocks
Strawberryrocks strawberry

Wed, 25 Sep 2024 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Wed, 25 Sep 2024 18:00:00 +0000

Type Values Removed Values Added
Description Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawberry HTTP view integrations vulnerable to cross-site request forgery (CSRF) attacks if users did not explicitly enable CSRF preventing security mechanism for their servers. Additionally, the Django HTTP view integration, in particular, had an exemption for Django's built-in CSRF protection (i.e., the `CsrfViewMiddleware` middleware) by default. In affect, all Strawberry integrations were vulnerable to CSRF attacks by default. Version `v0.243.0` is the first `strawberry-graphql` including a patch.
Title Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L'}


cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-09-25T17:48:24.065Z

Updated: 2024-09-25T18:05:24.810Z

Reserved: 2024-09-17T17:42:37.030Z

Link: CVE-2024-47082

cve-icon Vulnrichment

Updated: 2024-09-25T18:05:10.453Z

cve-icon NVD

Status : Analyzed

Published: 2024-09-25T18:15:05.417

Modified: 2024-10-01T20:01:13.367

Link: CVE-2024-47082

cve-icon Redhat

No data.