Affected: litestar-org litestar

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.

Affected: PyPI: litestar

# Overview

Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations.

We used the latest Litestar version available via PyPI for this disclosure. At the time of writing, that is version 2.21.0 and we have not validated this against the current latest commit on the main branch.

# Special Configurations Required

For a web application to be vulnerable to this issue, it must:

- Use templates to render the content which is returned to the user (e.g. Jinja, Mako, MiniJinja) - Have CSRF protection enabled - Have CSRF inputs enabled (i.e. a hidden form field which contains the CSRF token)

**Links to relevant documentation for the above configurations:**

- https://docs.litestar.dev/2/usage/templating.html - https://docs.litestar.dev/latest/usage/middleware/builtin-middleware.html#csrf - https://docs.litestar.dev/latest/usage/templating.html#adding-csrf-inputs

# Reproduction Steps

1. Visit an application which contains a form, uses templating, has CSRF protection enabled, and which inserts the CSRF token as a hidden `input` field on forms. A proof of concept application demonstrating this configuration is included later in this disclosure for ease of reproduction. 2. Observe that the server sets the `csrftoken` cooki…