FastAPI Experimental Task Feature Unauthorized Access/Bypass (CVE-2024-52870)

Experimental Task Handler Allows Any Client to Access and Cancel Other Clients' Tasks Vulnerability Overview In affected versions, the default request handler installed by the experimental tasks feature ( ) does not verify whether the session created the task before operating on it. On servers with multiple connected clients, any client can read results and cancel tasks from other clients' task queues. Scope Affected Versions: Fixed Version: CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: Low - Availability: Low CVE ID: CVE-2024-52870 Weakness: CWE-862 Remediation Upgrade to version 1.27.2 or later, where task IDs generated by are embedded with each session's token, and the default handler restricts each session to its own tasks: requests for tasks belonging to another session will receive a "Task Not Found" response, and will only return tasks for the requesting session. Tasks created explicitly via remain accessible by ID but are not listed. Alternatively, disable the experimental tasks feature, or register a custom task handler that verifies session ownership. Details When task support is enabled, default handlers are registered on the underlying server for , , , and . These handlers operate solely on task identifiers and do not record which session created each task. Since returns every task in storage, connected clients can enumerate all tasks, read the status of other tasks, and retrieve queued task messages via and without knowing any identifiers in advance—for example, canceling tasks submitted by their creators, which are removed from the queue upon delivery so the intended recipient never receives them—and cancel any task via . Impact Servers calling and serving multiple clients are affected: one client can read other clients' task status and cancellation payloads, consume messages and reset them, and cancel their tasks. This functionality is experimental and requires explicit enablement, so servers that never enabled it are unaffected. Servers that registered their own task handlers instead of the default are affected only if they share the same negligence. Mitigation Upgrade to version 1.27.2 or later, where task IDs generated by are embedded with each session's token, and the default handler restricts each session to its own tasks: requests for tasks belonging to another session will receive a "Task Not Found" response, and will only return tasks for the requesting session. Tasks created explicitly via remain accessible by ID but are not listed. Alternatively, disable the experimental tasks feature, or register a custom task handler that verifies session ownership.

Goal Reached Thanks to every supporter — we hit 100%!

FastAPI Experimental Task Feature Unauthorized Access/Bypass (CVE-2024-52870)

More from this source