Description — the form gives you 4 pre-built headers (Summary/Details/PoC/Impact). Replace the placeholder italics under each with this:
Summary
Quart 0.23.0 contains a stray debug statement (print(data)) inside Body.__await__ in quart/wrappers/request.py. Any request whose body is awaited — await request.form, await request.get_data(), WTForms validate_on_submit(), etc. — has its raw, unparsed body printed to stdout, including plaintext form fields such as passwords and CSRF tokens. Confirmed present in 0.23.0, confirmed absent in 0.22.0.
Details
In src/quart/wrappers/request.py, Body.__await__ accumulates the request body into a bytearray:
python data = bytearray() while not self._queue.empty(): data.extend(self._queue.get_nowait()) print(data) # <-- not present in 0.22.0 if ( self._max_content_length is not None and len(data) > self._max_content_length ): raise RequestEntityTooLarge()
This fires for every request that awaits its body — the overwhelming majority of POST/PUT routes in a typical Quart app (form submissions, JSON APIs via request.get_json(), file uploads, etc.).
PoC
pip install quart==0.23.0 (requires Python 3.13+)- Minimal route:
python @app.route("/login", methods=["POST"]) async def login(): form_data = await request.form ...
- Submit a POST with form data, e.g. a login form with
staff_id/password fields.
- Observe stdout: the full raw body is printed as
bytearray(b'csrf_token=...&staff_id=...&password=...').
Confirmed via source diff against 0.22.0's request.py, where this line does not exist.
Impact
Any app that captures stdout in logs (terminal redirect, systemd/journald, Docker logs, cloud log aggregation, etc.) will have every submitted form body — including login credentials — written to logs in plaintext. This affects any Quart 0.23.0 app handling authentication or any sensitive form data, and is trivially triggerable by any user simply submitting a form (no attacker action required beyond normal use).
Description — the form gives you 4 pre-built headers (Summary/Details/PoC/Impact). Replace the placeholder italics under each with this:
Summary
Quart 0.23.0 contains a stray debug statement (
print(data)) insideBody.__await__inquart/wrappers/request.py. Any request whose body is awaited —await request.form,await request.get_data(), WTFormsvalidate_on_submit(), etc. — has its raw, unparsed body printed to stdout, including plaintext form fields such as passwords and CSRF tokens. Confirmed present in 0.23.0, confirmed absent in 0.22.0.Details
In
src/quart/wrappers/request.py,Body.__await__accumulates the request body into a bytearray:
python data = bytearray() while not self._queue.empty(): data.extend(self._queue.get_nowait()) print(data) # <-- not present in 0.22.0 if ( self._max_content_length is not None and len(data) > self._max_content_length ): raise RequestEntityTooLarge() This fires for every request that awaits its body — the overwhelming majority of POST/PUT routes in a typical Quart app (form submissions, JSON APIs via
request.get_json(), file uploads, etc.).PoC
pip install quart==0.23.0(requires Python 3.13+)
python @app.route("/login", methods=["POST"]) async def login(): form_data = await request.form ... staff_id/passwordfields.bytearray(b'csrf_token=...&staff_id=...&password=...').Confirmed via source diff against 0.22.0's
request.py, where this line does not exist.Impact
Any app that captures stdout in logs (terminal redirect, systemd/journald, Docker logs, cloud log aggregation, etc.) will have every submitted form body — including login credentials — written to logs in plaintext. This affects any Quart 0.23.0 app handling authentication or any sensitive form data, and is trivially triggerable by any user simply submitting a form (no attacker action required beyond normal use).