CVE-2021-41265: Improper Authentication in Flask-AppBuilder
Summary
CVE-2021-41265: Improper Authentication in Flask-AppBuilder. Affects flask-appbuilder versions < 3.3.4. Fixed in 3.3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask-AppBuilder is a Python package that provides a framework for building web applications. It includes features such as authentication, authorization, and REST API endpoints. This vulnerability affects Flask-AppBuilder versions prior to 3.3.4. The package allows for non-database authentication types and new REST API endpoints. However, improper authentication on the REST API can enable a malicious actor to successfully authenticate and gain access to protected endpoints.
Vulnerability Detail
The vulnerability arises from a flaw in the authentication mechanism of Flask-AppBuilder's REST API. By crafting a carefully designed request, an attacker can bypass authentication and gain unauthorized access to protected endpoints. This vulnerability only affects non-database authentication types and new REST API endpoints. The impact of this vulnerability is significant as it allows an attacker to access sensitive data or perform unauthorized actions on the affected system.
How To Fix
Minimum fixed version
3.3.4
This is the first release that contains the fix.
pip install --upgrade "flask-appbuilder==3.3.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to Flask-AppBuilder 3.3.4 or later.
Conclusion
The vulnerability in Flask-AppBuilder allows for improper authentication on the REST API, enabling unauthorized access to protected endpoints. To mitigate this risk, it is recommended to upgrade to Flask-AppBuilder 3.3.4 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flask-appbuilder →
FAQ
Flask-AppBuilder is a Python package that provides a framework for building web applications. It includes features such as authentication, authorization, and REST API endpoints.
Flask-AppBuilder versions prior to 3.3.4 are affected by this vulnerability.
The vulnerability allows an attacker to bypass authentication and gain unauthorized access to protected REST API endpoints, potentially leading to unauthorized actions or access to sensitive data.
To fix this vulnerability, upgrade to Flask-AppBuilder 3.3.4 or later, which includes a patch for the improper authentication issue.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for flask-appbuilder.
