Starlette versions 1.0.1 and earlier on Windows are vulnerable to SSRF via the StaticFiles component when handling UNC paths. An attacker can cause the server to initiate an outbound SMB connection by providing a UNC path such as \\attacker.com\share, which leads to exposure of the service account's NTLMv2 credentials despite the HTTP response being a 404. This vulnerability affects default deployments with follow_symlink=false, including frameworks built on Starlette like FastAPI. POSIX systems and deployments with follow_symlink=true are not affected. The issue is resolved in version 1.1.0 of Starlette. Red Hat advisories confirm that their products are not impacted due to platform and configuration differences.

The vulnerability allows remote attackers to cause the server to initiate outbound SMB connections, potentially exposing NTLMv2 credentials of the service account. These credentials can be captured for offline cracking or relay attacks, leading to confidentiality breaches. The vulnerability does not impact integrity or availability. It is specific to Windows environments and default follow_symlink=false deployments. Red Hat products are not affected as they do not include the vulnerable code or run on Windows.

A fix is available in Starlette version 1.1.0. Users should upgrade to version 1.1.0 or later to remediate this vulnerability. Red Hat advisories state that their products are not affected and do not provide a mitigation for this issue. No alternative mitigations meeting Red Hat's criteria are currently available. Users on Windows should avoid using vulnerable versions and consider enabling follow_symlink=true if applicable, though the primary remediation is upgrading Starlette.