python-multipart vulnerable to Content-Type Header ReDoS
SummaryWhen using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options.An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests.This can create a ReDoS (Regular expression Denial of Service): https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoSThis only applies when the app uses form data, parsed with `python-multipart`.DetailsA regular HTTP `Content-Type` header could look like:`python-multipart` parses the option with this RegEx: https://github.com/andrew-d/python-multipart/blob/d3d16dae4b061c34fe9d3c9081d9800c49fc1f7a/multipart/multipart.py#L72-L74A custom option could be made and sent to the server to break it with:PoCCreate a simple WSGI application, that just parses the `Content-Type`, and run it with `python main.py`:Then send the attacking request with:ImpactThis is a ReDoS, (Regular expression Denial of Service), so it only applies to those using python-multipart to read form data, such as Starlette and FastAPI.Original ReportThis was originally reported to FastAPI as an email to security@tiangolo.com, sent via https://huntr.com/, the original reporter is Marcello, https://github.com/byt3bl33d3rHey Tiangolo!My name's Marcello and I work on the ProtectAI/Huntr Threat Research team, a few months ago we got a report (from @nicecatch2000) of a ReDoS affecting another very popular Python web framework. After some internal research, I found that FastAPI is vulnerable to the same ReDoS under certain conditions (only when it parses Form data not JSON).Here are the details: I'm using the latest version of FastAPI (0.109.0) and the following code:I'm running the above with uvicorn with the following command:Then run the following cUrl command:You'll see the server locks up, is unable to serve anymore requests and one CPU core is pegged to 100%You can even start uvicorn with multiple workers with the --workers 4 argument and as long as you send (workers + 1) requests you'll completely DoS the FastApi server.If you try submitting Json to the /submit_json endpoint with the malicious Content-Type header you'll see it isn't vulnerable. So this only affects FastAPI when it parses Form data.CheersImpactAn attacker is able to cause a DoS on a FastApi server via a malicious Content-Type header if it parses Form data.Occurrences[params.py L586](https://github.com/tiangolo/fastapi/blob/d74b3b25659b42233a669f032529880de8bd6c2d/fastapi/params.py#L586)