CVE-2024-40627

What it actually does

OpaMiddleware in fastapi-opa permits all unauthenticated HTTP OPTIONS requests to bypass policy evaluation and reach the application directly, enabling response-based inference of entity existence.

Why it matters to the business

Attackers can silently enumerate sensitive resources or data entities without credentials, increasing the risk of targeted follow-on attacks; the issue affects open-source middleware used in authentication flows with no ransomware association or high exploit activity.

How an attack unfolds

An attacker identifies applications using the vulnerable middleware and issues unauthenticated OPTIONS requests against endpoints whose responses differ based on whether an entity exists; differing replies reveal the presence of writable or protected objects without triggering authentication checks.

How to fix it

Upgrade busykoala/fastapi-opa to commit 9588109ff651f7ffc92687129c4956126443fb8c (release 2.0.1) or later; no workarounds exist.

How to confirm the fix worked

Confirm middleware version is at or above the fixed commit, then verify that OPTIONS requests without valid authentication now receive the same policy enforcement as other methods.

Typical attack path

1. Map target endpoints protected by fastapi-opa middleware
2. Issue HTTP OPTIONS requests lacking any authentication headers or tokens
3. Compare response status, headers, or body length across multiple entities
4. Catalog discovered entities for subsequent authenticated exploitation attempts

How to detect it

Search web server or application logs for high volumes of OPTIONS requests lacking Authorization headers or tokens, especially to endpoints that previously varied responses by entity presence.

What your security team should do

• Immediately upgrade all instances of fastapi-opa to the patched release
• Audit application endpoints that return entity-existence indicators via OPTIONS
• Add logging for unauthenticated OPTIONS traffic to detect enumeration attempts
• Review downstream dependents of the affected package for inherited exposure