CVE-2024-30248: Fastapi Starlette Staticfiles Missing Csp
The application mounts a `StaticFiles` directory without applying Content-Security-Policy (CSP) headers. If this directory serves user-uploaded files, an attacker could upload and execute malicious scripts (e.g., via embedded JavaScript in SVG files), leading to Stored Cross-Site Scripting (XSS). Wrap the `StaticFiles` application in a middleware that adds a
greprules fetch cve-2024-30248-fastapi-starlette-staticfiles-missing-csp --engine opengrepDescription
The application mounts a `StaticFiles` directory without applying Content-Security-Policy (CSP) headers. If this directory serves user-uploaded files, an attacker could upload and execute malicious scripts (e.g., via embedded JavaScript in SVG files), leading to Stored Cross-Site Scripting (XSS). Wrap the `StaticFiles` application in a middleware that adds a
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.