Listen to this Post
The Starlette ASGI framework prior to version 1.0.1 is vulnerable to a host header validation bypass that allows attackers to poison the `request.url.path` attribute and circumvent path‑based security controls. The root cause is the absence of validation on the HTTP `Host` header before it is used to reconstruct the full request URL.
When a client requests `http://example.com/foo`, the HTTP request line is `GET /foo HTTP/1.1with a `Host: example.com` header. Starlette reconstructs the URL by concatenating `{scheme}://{host_header}{path}` and then re‑parsing the result. Because the routing algorithm relies on the raw HTTP path from the request line, while `request.url` is rebuilt from the `Host` header, a malformed `Host` value can cause the parsed `request.url.path` to differ from the path that was actually requested./
The `Host` header is only valid as a `uri-host [ ":" port ]` per RFC 9112 §3.2, where `uri-host` follows the restricted grammar of RFC 3986 §3.2.2. When the header contains characters outside that grammar—notably,?, or ``—those characters shift the path/query/fragment boundaries during re‑parsing. For example, a request `GET /foo HTTP/1.1 Host: example.com/abc?bar=` reconstructs tohttp://example.com/abc?bar=/foo`, whose parsed path is /abc—even though routing used the real path /foo. The router still dispatches to the `/foo` endpoint, but any middleware or code that reads `request.url.path` sees /abc, allowing path‑based authorization checks to be bypassed.
Any application running an affected version that relies on `request.url` or `request.url.path` for security‑sensitive decisions is vulnerable. The most common case is middleware that gates access to certain path prefixes based on request.url.path. Deployments fronted by a proxy are mitigated only if that proxy rejects or normalizes the malformed `Host` header before forwarding and the application does not trust attacker‑controlled host headers elsewhere. The fix, introduced in version 1.0.1, validates the `Host` header against the RFC grammar and falls back to `scope[“server”]` for malformed values.
DailyCVE Form:
Platform: Starlette
Version: 0.8.3 – 1.0.0
Vulnerability: Host Header Validation Bypass
Severity: MEDIUM (CVSS 6.5)
date: 2026
Prediction: Patch available (1.0.1)
What Undercode Say:
Check installed Starlette version pip show starlette | grep Version Upgrade to patched version pip install --upgrade starlette>=1.0.1
Exploit: (Educational Purposes!)
Malformed Host header PoC
import httpx
Target endpoint with path-based auth middleware
url = "http://target.com/admin"
Malformed Host header injects '/public' into request.url.path
headers = {"Host": "target.com/public?x="}
response = httpx.get(url, headers=headers)
Despite requesting /admin, middleware sees /public and grants access
print(response.status_code) 200 instead of 403
print(response.text)
Protection:
- Upgrade to Starlette 1.0.1 or later immediately.
- If unable to upgrade, deploy a reverse proxy that validates and rejects malformed `Host` headers before forwarding requests.
- Avoid relying on `request.url.path` for security decisions; use the raw `scope[“path”]` from the ASGI scope where possible.
Impact:
- Authentication Bypass: Middleware that restricts access based on `request.url.path` can be tricked into allowing unauthorized requests.
- SSRF & RCE: In complex applications, this inconsistent URL interpretation can lead to Server‑Side Request Forgery and, in some cases, Remote Code Execution.
- Widespread Exposure: Starlette is the foundation of FastAPI and many other Python ASGI frameworks, amplifying the potential attack surface.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
