From 43ba88d466f071bffcb358f1b54b680192a134bc Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 25 Sep 2024 18:22:47 +0000
Subject: [PATCH] Publish GHSA-79gp-q4wv-33fr

---
 .../GHSA-79gp-q4wv-33fr.json                  | 65 +++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/09/GHSA-79gp-q4wv-33fr/GHSA-79gp-q4wv-33fr.json

diff --git a/advisories/github-reviewed/2024/09/GHSA-79gp-q4wv-33fr/GHSA-79gp-q4wv-33fr.json b/advisories/github-reviewed/2024/09/GHSA-79gp-q4wv-33fr/GHSA-79gp-q4wv-33fr.json
new file mode 100644
index 00000000000..24ebd78fca7
--- /dev/null
+++ b/advisories/github-reviewed/2024/09/GHSA-79gp-q4wv-33fr/GHSA-79gp-q4wv-33fr.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-79gp-q4wv-33fr",
+  "modified": "2024-09-25T18:21:20Z",
+  "published": "2024-09-25T18:21:19Z",
+  "aliases": [
+    "CVE-2024-47082"
+  ],
+  "summary": "Cross-Site Request Forgery (CSRF) in strawberry-graphql",
+  "details": "### Impact\n\nMultipart file upload support as defined in the [GraphQL multipart request specification](https://github.com/jaydenseric/graphql-multipart-request-spec) was enabled by default in all Strawberry HTTP view integrations. This made all Strawberry HTTP view integrations vulnerable to CSRF attacks if users did not explicitly enable CSRF preventing security mechanism for their servers.\nAdditionally, the Django HTTP view integration, in particular, had an exemption for Django's built-in CSRF protection (i.e., the `CsrfViewMiddleware` middleware) by default.\n\nIn affect, all Strawberry integrations were vulnerable to CSRF attacks by default.\n\n### Patches\n\nVersion `v0.243.0` is the first `strawberry-graphql` including a patch. Check out our [documentation](https://strawberry.rocks/docs/breaking-changes/0.243.0) for additional details and upgrade instructions.\n\n### References\n\n- [Strawberry upgrade guide](https://strawberry.rocks/docs/breaking-changes/0.243.0)\n- [Multipart Upload Security Implications](https://github.com/jaydenseric/graphql-multipart-request-spec/blob/master/readme.md#security)\n\n### Credits\n\n- [Thomas Grainger](https://github.com/graingert)\n- [Arthur Bayr](https://github.com/speedy1991)\n- [Jonathan Ehwald](https://github.com/DoctorJohn)",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "strawberry-graphql"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.243.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-79gp-q4wv-33fr"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/strawberry-graphql/strawberry/commit/37265b230e511480a9ceace492f9f6a484be1387"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/strawberry-graphql/strawberry"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-352"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-09-25T18:21:19Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file