Description
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jowilf | starlette-admin | 0.16.1 – ≤ 0.17.1 | — |
References
- Unenforced searchable_fields allowlist in _validate_where() at 0.17.1 technical-description
- https://github.com/jowilf/starlette-admin product
- VulnCheck Advisory: starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass third-party-advisory