CVE-2024-30248 (published 2024-04-02T15:15Z)

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin page. This vulnerability was patched in version 1.3.2.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/piccolo-orm/piccolo_admin
commit_details: repo_url: https://github.com/piccolo-orm/piccolo_admin
author: Daniel Townsend
author_date: 2024-03-30 13:18:29+00:00
msg: Merge pull request from GHSA-pmww-v6c9-7p83

* feat: add csp headers on media routes

* feat: use CSPMiddleware instead

* chore: bump piccolo API version

---------

Co-authored-by: skelmis <ethanmkh2@gmail.com>
repository: repo_url: https://github.com/piccolo-orm/piccolo_admin
repo_name: piccolo-orm/piccolo_admin
description: A powerful web admin for your database.
repo_language: Python
owner: piccolo-orm
file_changes: filename: endpoints.py
change_type: ModificationType.MODIFY
diff: @@ -30,6 +30,7 @@ from piccolo_api.change_password.endpoints import change_password
 from piccolo_api.crud.endpoints import OrderBy, PiccoloCRUD
 from piccolo_api.crud.hooks import Hook
 from piccolo_api.crud.validators import Validators
+from piccolo_api.csp.middleware import CSPMiddleware, CSPConfig
 from piccolo_api.csrf.middleware import CSRFMiddleware
 from piccolo_api.fastapi.endpoints import FastAPIKwargs, FastAPIWrapper
 from piccolo_api.media.base import MediaStorage
@@ -667,11 +668,17 @@ class AdminRouter(FastAPI):
                     media_storage,
                 ) in table_config.media_columns.items():
                     if isinstance(media_storage, LocalMediaStorage):
+                        # We apply a restrictive CSP here to mitigate SVG
+                        # files being used maliciously when viewed by admins
                         private_app.mount(
-                            path=f"/media-files/{column._meta.table._meta.tablename}/{column._meta.name}/",  # noqa: E501
-                            app=StaticFiles(
-                                directory=media_storage.media_path
-                            ),
+                            path=f"/media-files/{column._meta.table._meta.tablename}/{column._meta.name}/",
+                            # noqa: E501
+                            app=CSPMiddleware(
+                                StaticFiles(
+                                    directory=media_storage.media_path
+                                ),
+                                config=CSPConfig(default_src="none")
+                            )
                         )
 
         #######################################################################

programming_language: Python
filename: requirements.txt
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 piccolo>=1.5.0
-piccolo_api>=1.1.0
+piccolo_api>=1.3.1
 uvicorn
 aiofiles>=0.5.0
 Hypercorn

programming_language: Batchfile