CVE-2022-24776: Open Redirect in Flask-AppBuilder
Summary
CVE-2022-24776: Open Redirect in Flask-AppBuilder. Affects flask-appbuilder versions < 3.4.5. Fixed in 3.4.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask-AppBuilder is an application development framework built on top of Flask. It provides a set of reusable components and tools for building web applications. Flask-AppBuilder versions prior to 3.4.5 are affected by an open redirect vulnerability when using the database authentication login page. This vulnerability allows an attacker to redirect users to malicious websites, potentially leading to phishing attacks or the disclosure of sensitive information.
Vulnerability Detail
The open redirect vulnerability in Flask-AppBuilder arises due to insufficient validation of user-supplied input. By manipulating the redirect URL parameter, an attacker can craft a malicious URL that appears to be legitimate but redirects the user to a different website. This can be exploited to trick users into visiting phishing websites or disclosing sensitive information. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.4.5
This is the first release that contains the fix.
pip install --upgrade "flask-appbuilder==3.4.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Flask-AppBuilder versions prior to 3.4.5 are vulnerable to an open redirect attack. This can lead to phishing attacks and the disclosure of sensitive information. It is crucial to upgrade to version 3.4.5 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flask-appbuilder →
FAQ
Flask-AppBuilder is an application development framework built on top of Flask. It provides a set of reusable components and tools for building web applications.
An open redirect vulnerability occurs when a web application allows external input to control the destination of a redirect. Attackers can manipulate the redirect URL to trick users into visiting malicious websites.
This vulnerability can be exploited by attackers to redirect users to phishing websites or disclose sensitive information. It can lead to account compromise, data theft, or other malicious activities.
No, there are no known workarounds for this vulnerability. Upgrading to the latest version of Flask-AppBuilder is the recommended solution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for flask-appbuilder.
