Workflow

PyPi: Flask-Cors

CVE-2024-1681

Safety vulnerability ID: 70624

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Apr 19, 2024 Updated at May 04, 2024
Scan your Python projects for vulnerabilities →

Advisory

corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs. See CVE-2024-1681.

Affected package

flask-cors

Latest version: 4.0.1

A Flask extension adding a decorator for CORS support

Affected versions

Fixed versions

Vulnerability changelog

corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs. See CVE-2024-1681.


MISC:https://huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644: https://huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application