CVE-2024-47082

Advisory

Affected versions of strawberry-graphql are vulnerable to Cross-Site Request Forgery (CSRF) and insufficient security in multipart file uploads. CSRF attacks allow unauthorized actions to be performed on behalf of authenticated users due to the implicit CSRF exemption in Strawberry’s Django integration. Additionally, multipart uploads were enabled by default without proper security controls, making them susceptible to malicious file uploads. These issues are resolved by requiring explicit opt-in for multipart uploads and enforcing CSRF protection.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-79gp-q4wv-33fr
• https://github.com/strawberry-graphql/strawberry/commit/37265b230e511480a9ceace492f9f6a484be1387
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47082