CORS Configuration Vulnerability in python-flask-cors: Inconsistent Handling of '+' Character
Summary
CVE-2024-6844: A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. Affects python-flask-cors across 2 version ranges.
< 1df178ccc019c5aa7282246288c04f867d716790
< 3.0.9-2+deb11u1
Fixed in 3.0.9-2+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-flask-cors is a widely used package that enables Cross-Origin Resource Sharing (CORS) in Flask applications. It allows developers to specify which domains are permitted to access resources on their server, enhancing security and usability. However, a vulnerability has been identified in version 4.0.1, where the handling of the '+' character in URL paths leads to inconsistent CORS matching, potentially exposing applications to unauthorized access or blocking legitimate requests.
Vulnerability Detail
A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
How To Fix
Minimum fixed version
3.0.9-2+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-flask-corsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually handle the '+' character in your application by replacing it with '%2B' in the URL paths before they are processed by the CORS middleware. This can be done using Flask's before_request decorator to modify the request path.
Conclusion
The vulnerability in python-flask-cors version 4.0.1 poses significant risks related to CORS configuration due to improper handling of the '+' character in URL paths. It is crucial to update to a patched version or implement a workaround to mitigate these risks and ensure the security of your applications.
See every vulnerability recorded for python-flask-cors →
FAQ
The vulnerability can lead to unauthorized cross-origin access or block legitimate requests, compromising the security and functionality of your application.
The vulnerability affects version 4.0.1 of python-flask-cors. It is recommended to upgrade to a version higher than 4.0.1.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If an immediate upgrade is not possible, implement the suggested workaround to handle the '+' character in URL paths until you can update the package.
Yes, Vulert provides a solution that uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for python-flask-cors.
