CVE-2023-30798
📋 TL;DR
This vulnerability in Starlette's MultipartParser allows remote attackers to cause denial of service by sending excessive multipart form data, leading to high memory consumption. It affects unauthenticated users and impacts HTTP services built with vulnerable versions of the Starlette framework.
💻 Affected Systems
- Starlette
📦 What is this software?
Starlette by Encode
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to memory exhaustion, potentially crashing the server and disrupting all HTTP functionality.
Likely Case
Degraded performance or temporary service outages under targeted attacks, affecting application responsiveness.
If Mitigated
Minimal impact with proper rate limiting, input validation, and updated software, though some resource strain may occur.
🎯 Exploit Status
Exploitation is straightforward via crafted HTTP requests; public proof-of-concept code is available in advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.25.0 and later
Vendor Advisory: https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x
Restart Required: Yes
Instructions:
1. Update Starlette using pip: 'pip install --upgrade starlette>=0.25.0'. 2. Restart the application or server to apply changes. 3. Verify the version with 'pip show starlette'.
🔧 Temporary Workarounds
Implement request size limits
allConfigure web server or application to limit multipart request sizes to reduce memory impact.
Example for a reverse proxy like nginx: 'client_max_body_size 10M;' in nginx.conf
Disable multipart parsing if unused
allIf the application does not require multipart form handling, disable or restrict it in Starlette configuration.
In Starlette app, avoid using 'request.form()' or limit its use to specific endpoints.
🧯 If You Can't Patch
- Deploy rate limiting and input validation at the network or application layer to block excessive requests.
- Monitor memory usage and set up alerts for unusual spikes to enable rapid response to potential attacks.
🔍 How to Verify
Check if Vulnerable:
Check the Starlette version in your Python environment; if it is below 0.25.0, it is vulnerable.Check Version:
pip show starlette | grep VersionVerify Fix Applied:
After updating, confirm the version is 0.25.0 or higher and test multipart requests to ensure no memory exhaustion occurs.📡 Detection & Monitoring
Log Indicators:
- Unusually large HTTP POST requests, spikes in memory usage logs, or error messages related to multipart parsing.
Network Indicators:
- High volume of multipart/form-data requests from single sources or abnormal request sizes.
SIEM Query:
Example: 'source=web_logs method=POST content_type=multipart/form-data size>10MB | stats count by src_ip'🔗 References
- https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa
- https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x
- https://vulncheck.com/advisories/starlette-multipartparser-dos
- https://github.com/encode/starlette/commit/8c74c2c8dba7030154f8af18e016136bea1938fa
- https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x
- https://vulncheck.com/advisories/starlette-multipartparser-dos
