Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by starliteproject
CVE-2024-32982 (GCVE-0-2024-32982)
Vulnerability from nvd – Published: 2024-05-06 14:38 – Updated: 2024-08-02 02:27
VLAI
EPSS
VEX
Title
Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion (LFI) vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to sensitive files outside the designated directories. Such access can lead to the disclosure of sensitive information or potentially compromise the server. The vulnerability is located in the file path handling mechanism within the static content serving function, specifically at `litestar/static_files/base.py`. This vulnerability is fixed in versions 2.8.3, 2.7.2, and 2.6.4.
Severity
8.2 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-03 14:26 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/litestar-org/litestar/security… | x_refsource_CONFIRM |
| https://github.com/litestar-org/litestar/commit/5… | x_refsource_MISC |
| https://github.com/litestar-org/litestar/blob/mai… | x_refsource_MISC |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| litestar-org | litestar |
Affected:
>= 2.8.0, < 2.8.3
Affected: >= 1.37.0, <= 1.51.14 Affected: >= 2.7.0, < 2.7.2 Affected: >= 2.0.0, < 2.6.4 |
|
| starliteproject | starlite |
Affected:
1.37.0 , ≤ 1.51.14
(custom)
cpe:2.3:a:starliteproject:starlite:1.37.0:*:*:*:*:*:*:* |
|
| starliteproject | starlite |
Affected:
2.0.0 , < 2.6.4
(custom)
cpe:2.3:a:starliteproject:starlite:2.0.0:*:*:*:*:*:*:* |
|
| starliteproject | starlite |
Affected:
2.7.0 , < 2.7.2
(custom)
cpe:2.3:a:starliteproject:starlite:2.7.0:*:*:*:*:*:*:* |
|
| starliteproject | starlite |
Affected:
2.8.0 , < 2.8.3
(custom)
cpe:2.3:a:starliteproject:starlite:2.8.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:starliteproject:starlite:1.37.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "starlite",
"vendor": "starliteproject",
"versions": [
{
"lessThanOrEqual": "1.51.14",
"status": "affected",
"version": "1.37.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:starliteproject:starlite:2.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "starlite",
"vendor": "starliteproject",
"versions": [
{
"lessThan": "2.6.4",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:starliteproject:starlite:2.7.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "starlite",
"vendor": "starliteproject",
"versions": [
{
"lessThan": "2.7.2",
"status": "affected",
"version": "2.7.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:starliteproject:starlite:2.8.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "starlite",
"vendor": "starliteproject",
"versions": [
{
"lessThan": "2.8.3",
"status": "affected",
"version": "2.8.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32982",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-03T14:26:20.026909Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-03T20:55:45.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:27:53.331Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf"
},
{
"name": "https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b"
},
{
"name": "https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "litestar",
"vendor": "litestar-org",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.8.0, \u003c 2.8.3"
},
{
"status": "affected",
"version": "\u003e= 1.37.0, \u003c= 1.51.14"
},
{
"status": "affected",
"version": "\u003e= 2.7.0, \u003c 2.7.2"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2.6.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion (LFI) vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to sensitive files outside the designated directories. Such access can lead to the disclosure of sensitive information or potentially compromise the server. The vulnerability is located in the file path handling mechanism within the static content serving function, specifically at `litestar/static_files/base.py`. This vulnerability is fixed in versions 2.8.3, 2.7.2, and 2.6.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-06T20:50:00.744Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf"
},
{
"name": "https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b"
},
{
"name": "https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70"
}
],
"source": {
"advisory": "GHSA-83pv-qr33-2vcf",
"discovery": "UNKNOWN"
},
"title": "Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32982",
"datePublished": "2024-05-06T14:38:10.875Z",
"dateReserved": "2024-04-22T15:14:59.167Z",
"dateUpdated": "2024-08-02T02:27:53.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-25578 (GCVE-0-2023-25578)
Vulnerability from nvd – Published: 2023-02-15 14:58 – Updated: 2025-03-10 21:10
VLAI
EPSS
VEX
Title
Starlite DoS vulnerability when parsing multipart request body
Summary
Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 1.5.2, the request body parsing in `starlite` allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts and an unlimited number of field parts. This is a remote, potentially unauthenticated Denial of Service vulnerability. This vulnerability affects applications with a request handler that accepts a `Body(media_type=RequestEncodingType.MULTI_PART)`. The large amount of CPU time required for processing requests can block all available worker processes and significantly delay or slow down the processing of legitimate user requests. The large amount of RAM accumulated while processing requests can lead to Out-Of-Memory kills. Complete DoS is achievable by sending many concurrent multipart requests in a loop. Version 1.51.2 contains a patch for this issue.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-10 21:01 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/starlite-api/starlite/security… | x_refsource_CONFIRM |
| https://github.com/starlite-api/starlite/commit/9… | x_refsource_MISC |
| https://github.com/starlite-api/starlite/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| starlite-api | starlite |
Affected:
< 1.51.2
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:25:19.300Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/starlite-api/starlite/security/advisories/GHSA-p24m-863f-fm6q",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/starlite-api/starlite/security/advisories/GHSA-p24m-863f-fm6q"
},
{
"name": "https://github.com/starlite-api/starlite/commit/9674fe803628f986c03fe60769048cbc55b5bf83",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/starlite-api/starlite/commit/9674fe803628f986c03fe60769048cbc55b5bf83"
},
{
"name": "https://github.com/starlite-api/starlite/releases/tag/v1.51.2",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/starlite-api/starlite/releases/tag/v1.51.2"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-25578",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-10T21:01:52.089906Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-10T21:10:58.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "starlite",
"vendor": "starlite-api",
"versions": [
{
"status": "affected",
"version": "\u003c 1.51.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 1.5.2, the request body parsing in `starlite` allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts and an unlimited number of field parts. This is a remote, potentially unauthenticated Denial of Service vulnerability. This vulnerability affects applications with a request handler that accepts a `Body(media_type=RequestEncodingType.MULTI_PART)`. The large amount of CPU time required for processing requests can block all available worker processes and significantly delay or slow down the processing of legitimate user requests. The large amount of RAM accumulated while processing requests can lead to Out-Of-Memory kills. Complete DoS is achievable by sending many concurrent multipart requests in a loop. Version 1.51.2 contains a patch for this issue.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-15T14:58:31.829Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/starlite-api/starlite/security/advisories/GHSA-p24m-863f-fm6q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/starlite-api/starlite/security/advisories/GHSA-p24m-863f-fm6q"
},
{
"name": "https://github.com/starlite-api/starlite/commit/9674fe803628f986c03fe60769048cbc55b5bf83",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/starlite-api/starlite/commit/9674fe803628f986c03fe60769048cbc55b5bf83"
},
{
"name": "https://github.com/starlite-api/starlite/releases/tag/v1.51.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/starlite-api/starlite/releases/tag/v1.51.2"
}
],
"source": {
"advisory": "GHSA-p24m-863f-fm6q",
"discovery": "UNKNOWN"
},
"title": "Starlite DoS vulnerability when parsing multipart request body"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-25578",
"datePublished": "2023-02-15T14:58:31.829Z",
"dateReserved": "2023-02-07T17:10:00.743Z",
"dateUpdated": "2025-03-10T21:10:58.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-32982 (GCVE-0-2024-32982)
Vulnerability from cvelistv5 – Published: 2024-05-06 14:38 – Updated: 2024-08-02 02:27
VLAI
EPSS
VEX
Title
Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion (LFI) vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to sensitive files outside the designated directories. Such access can lead to the disclosure of sensitive information or potentially compromise the server. The vulnerability is located in the file path handling mechanism within the static content serving function, specifically at `litestar/static_files/base.py`. This vulnerability is fixed in versions 2.8.3, 2.7.2, and 2.6.4.
Severity
8.2 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-03 14:26 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/litestar-org/litestar/security… | x_refsource_CONFIRM |
| https://github.com/litestar-org/litestar/commit/5… | x_refsource_MISC |
| https://github.com/litestar-org/litestar/blob/mai… | x_refsource_MISC |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| litestar-org | litestar |
Affected:
>= 2.8.0, < 2.8.3
Affected: >= 1.37.0, <= 1.51.14 Affected: >= 2.7.0, < 2.7.2 Affected: >= 2.0.0, < 2.6.4 |
|
| starliteproject | starlite |
Affected:
1.37.0 , ≤ 1.51.14
(custom)
cpe:2.3:a:starliteproject:starlite:1.37.0:*:*:*:*:*:*:* |
|
| starliteproject | starlite |
Affected:
2.0.0 , < 2.6.4
(custom)
cpe:2.3:a:starliteproject:starlite:2.0.0:*:*:*:*:*:*:* |
|
| starliteproject | starlite |
Affected:
2.7.0 , < 2.7.2
(custom)
cpe:2.3:a:starliteproject:starlite:2.7.0:*:*:*:*:*:*:* |
|
| starliteproject | starlite |
Affected:
2.8.0 , < 2.8.3
(custom)
cpe:2.3:a:starliteproject:starlite:2.8.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:starliteproject:starlite:1.37.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "starlite",
"vendor": "starliteproject",
"versions": [
{
"lessThanOrEqual": "1.51.14",
"status": "affected",
"version": "1.37.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:starliteproject:starlite:2.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "starlite",
"vendor": "starliteproject",
"versions": [
{
"lessThan": "2.6.4",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:starliteproject:starlite:2.7.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "starlite",
"vendor": "starliteproject",
"versions": [
{
"lessThan": "2.7.2",
"status": "affected",
"version": "2.7.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:starliteproject:starlite:2.8.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "starlite",
"vendor": "starliteproject",
"versions": [
{
"lessThan": "2.8.3",
"status": "affected",
"version": "2.8.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-32982",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-03T14:26:20.026909Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-03T20:55:45.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:27:53.331Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf"
},
{
"name": "https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b"
},
{
"name": "https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "litestar",
"vendor": "litestar-org",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.8.0, \u003c 2.8.3"
},
{
"status": "affected",
"version": "\u003e= 1.37.0, \u003c= 1.51.14"
},
{
"status": "affected",
"version": "\u003e= 2.7.0, \u003c 2.7.2"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2.6.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Litestar and Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.8.3, 2.7.2, and 2.6.4, a Local File Inclusion (LFI) vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to sensitive files outside the designated directories. Such access can lead to the disclosure of sensitive information or potentially compromise the server. The vulnerability is located in the file path handling mechanism within the static content serving function, specifically at `litestar/static_files/base.py`. This vulnerability is fixed in versions 2.8.3, 2.7.2, and 2.6.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-06T20:50:00.744Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf"
},
{
"name": "https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b"
},
{
"name": "https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70"
}
],
"source": {
"advisory": "GHSA-83pv-qr33-2vcf",
"discovery": "UNKNOWN"
},
"title": "Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-32982",
"datePublished": "2024-05-06T14:38:10.875Z",
"dateReserved": "2024-04-22T15:14:59.167Z",
"dateUpdated": "2024-08-02T02:27:53.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-25578 (GCVE-0-2023-25578)
Vulnerability from cvelistv5 – Published: 2023-02-15 14:58 – Updated: 2025-03-10 21:10
VLAI
EPSS
VEX
Title
Starlite DoS vulnerability when parsing multipart request body
Summary
Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 1.5.2, the request body parsing in `starlite` allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts and an unlimited number of field parts. This is a remote, potentially unauthenticated Denial of Service vulnerability. This vulnerability affects applications with a request handler that accepts a `Body(media_type=RequestEncodingType.MULTI_PART)`. The large amount of CPU time required for processing requests can block all available worker processes and significantly delay or slow down the processing of legitimate user requests. The large amount of RAM accumulated while processing requests can lead to Out-Of-Memory kills. Complete DoS is achievable by sending many concurrent multipart requests in a loop. Version 1.51.2 contains a patch for this issue.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-10 21:01 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/starlite-api/starlite/security… | x_refsource_CONFIRM |
| https://github.com/starlite-api/starlite/commit/9… | x_refsource_MISC |
| https://github.com/starlite-api/starlite/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| starlite-api | starlite |
Affected:
< 1.51.2
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:25:19.300Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/starlite-api/starlite/security/advisories/GHSA-p24m-863f-fm6q",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/starlite-api/starlite/security/advisories/GHSA-p24m-863f-fm6q"
},
{
"name": "https://github.com/starlite-api/starlite/commit/9674fe803628f986c03fe60769048cbc55b5bf83",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/starlite-api/starlite/commit/9674fe803628f986c03fe60769048cbc55b5bf83"
},
{
"name": "https://github.com/starlite-api/starlite/releases/tag/v1.51.2",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/starlite-api/starlite/releases/tag/v1.51.2"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-25578",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-10T21:01:52.089906Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-10T21:10:58.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "starlite",
"vendor": "starlite-api",
"versions": [
{
"status": "affected",
"version": "\u003c 1.51.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Starlite is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 1.5.2, the request body parsing in `starlite` allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. The multipart body parser processes an unlimited number of file parts and an unlimited number of field parts. This is a remote, potentially unauthenticated Denial of Service vulnerability. This vulnerability affects applications with a request handler that accepts a `Body(media_type=RequestEncodingType.MULTI_PART)`. The large amount of CPU time required for processing requests can block all available worker processes and significantly delay or slow down the processing of legitimate user requests. The large amount of RAM accumulated while processing requests can lead to Out-Of-Memory kills. Complete DoS is achievable by sending many concurrent multipart requests in a loop. Version 1.51.2 contains a patch for this issue.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-15T14:58:31.829Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/starlite-api/starlite/security/advisories/GHSA-p24m-863f-fm6q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/starlite-api/starlite/security/advisories/GHSA-p24m-863f-fm6q"
},
{
"name": "https://github.com/starlite-api/starlite/commit/9674fe803628f986c03fe60769048cbc55b5bf83",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/starlite-api/starlite/commit/9674fe803628f986c03fe60769048cbc55b5bf83"
},
{
"name": "https://github.com/starlite-api/starlite/releases/tag/v1.51.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/starlite-api/starlite/releases/tag/v1.51.2"
}
],
"source": {
"advisory": "GHSA-p24m-863f-fm6q",
"discovery": "UNKNOWN"
},
"title": "Starlite DoS vulnerability when parsing multipart request body"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-25578",
"datePublished": "2023-02-15T14:58:31.829Z",
"dateReserved": "2023-02-07T17:10:00.743Z",
"dateUpdated": "2025-03-10T21:10:58.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}