Nic-Lovin

**Name of the Vulnerable Software and Affected Versions** starlette versions prior to 1.3.1 **Description** The HTTP request path is not validated before being used to reconstruct `request.url`. When a path does not begin with `/`, such as `@google.com`, it is concatenated as `{scheme}://{host}{path}`. This shifts the authority boundary during re-parsing, causing `request.url.hostname` and `request.url.netloc` to be controlled by an attacker. Consequently, applications using these variables for security-sensitive decisions—such as host-based authorization, SSRF targets, or cache keys—can be misled into trusting an attacker-supplied host. This issue requires an ASGI server that forwards a request-target lacking a leading `/` into `scope["path"]`. The impact is primarily limited to middleware or 404/exception handlers, as the malformed path typically does not match registered routes. **Recommendations** Upgrade to version 1.3.1 or newer.

**Name of the Vulnerable Software and Affected Versions** Starlette versions prior to 1.0.1 **Description** Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework, fails to validate the HTTP `Host` request header before using it to reconstruct `request.url`. While the routing algorithm uses the raw HTTP path, `request.url` is rebuilt using the `Host` header. An attacker can send a specially crafted `Host` header containing characters such as `/`, `?`, or `#` to shift path, query, or fragment boundaries during re-parsing. This causes `request.url.path` to differ from the actual requested path. Consequently, middleware or endpoints that enforce security restrictions based on `request.url` (instead of the raw `scope` path) can be bypassed, potentially allowing unauthorized access to protected endpoints. **Recommendations** Upgrade to version 1.0.1 or later. As a temporary workaround, use `request.scope["path"]` instead of `request.url.path` for security-sensitive decisions. Restrict or normalize the `Host` header at the reverse proxy or load balancer level before it reaches the application.