CVE-2024-45314: Flask-AppBuilder Login Form Caching Vulnerability
Summary
CVE-2024-45314: Flask-AppBuilder's login form allows browser to cache sensitive fields. Affects flask-appbuilder versions < 4.5.1. Fixed in 4.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask-AppBuilder is a popular framework for building web applications in Python, providing a robust set of tools for authentication, database management, and user interface design. It is widely used for creating data-driven applications. However, it has a vulnerability in its login form that allows sensitive data to be cached by browsers, posing a risk in shared environments.
Vulnerability Detail
The vulnerability arises from the default cache directives set for the authentication database login form in Flask-AppBuilder. These directives permit browsers to locally store sensitive data, such as usernames and passwords. This can lead to unauthorized access if multiple users share a computer or if the device is not secured properly. The issue is particularly critical in environments where sensitive information is handled, as it can expose user credentials to unintended parties.
How To Fix
Minimum fixed version
4.5.1
This is the first release that contains the fix.
pip install --upgrade "flask-appbuilder==4.5.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not feasible, configure your web server to send the following HTTP headers for the /login endpoint to prevent caching of sensitive data:
"Cache-Control": "no-store, no-cache, must-revalidate, max-age=0" "Pragma": "no-cache" "Expires": "0"
Conclusion
In summary, CVE-2024-45314 is a significant vulnerability in Flask-AppBuilder that can lead to the caching of sensitive login information by browsers. It is crucial to upgrade to the patched version or implement the suggested workarounds to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for flask-appbuilder →
FAQ
CVE-2024-45314 is a vulnerability in Flask-AppBuilder that allows browsers to cache sensitive fields in the login form, potentially exposing user credentials.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to analyze your application without signup.
The risks include unauthorized access to user accounts and exposure of sensitive information, especially in shared computing environments.
Yes, upgrading Flask-AppBuilder to version 4.5.1 or later will patch this vulnerability.
If immediate upgrading is not possible, implement the recommended HTTP headers to prevent caching of sensitive data in the login form.
References
Related vulnerabilities
Recent vulnerabilities recorded for flask-appbuilder.
