CVE-2021-29621: User Enumeration in Flask-AppBuilder <= 3.2.3
Summary
CVE-2021-29621: Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder. Affects flask-appbuilder across 2 version ranges.
< 3.3.0
< 780bd0e8fbf2d36ada52edb769477e0a4edae580
Fixed in 780bd0e8fbf2d36ada52edb769477e0a4edae580. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2021-29621 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask-AppBuilder is a development framework built on top of Flask. It provides a set of tools and functionalities to simplify the process of building Flask-based applications. Flask-AppBuilder allows for database authentication, enabling users to log in and access the application. However, versions up to and including 3.2.3 are vulnerable to user enumeration, which allows a non-authenticated user to enumerate existing accounts by timing the response time from the server during the login process.
Vulnerability Detail
The vulnerability in Flask-AppBuilder arises from the lack of proper authentication checks during the login process. By measuring the response time from the server, an attacker can determine whether a username exists in the system. This information can be used to perform targeted attacks, such as brute-forcing passwords for known usernames. The vulnerability can lead to unauthorized access to user accounts and potential data breaches. It is important to note that this vulnerability only affects Flask-AppBuilder versions up to and including 3.2.3.
How To Fix
Minimum fixed version
780bd0e8fbf2d36ada52edb769477e0a4edae580
This is the first release that contains the fix.
pip install --upgrade "flask-appbuilder==780bd0e8fbf2d36ada52edb769477e0a4edae580"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to implement additional security measures, such as rate limiting or account lockouts, to mitigate the risk of brute-force attacks.
Conclusion
Flask-AppBuilder versions up to and including 3.2.3 are vulnerable to user enumeration, which can lead to unauthorized access and potential data breaches. It is crucial to upgrade to version 3.3.0 or higher to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flask-appbuilder →
FAQ
Flask-AppBuilder is a development framework built on top of Flask, providing tools and functionalities to simplify Flask-based application development.
User enumeration is a technique used by attackers to determine the existence of user accounts in a system. In this vulnerability, an attacker can measure the response time from the server during the login process to determine if a username exists.
This vulnerability can lead to unauthorized access to user accounts and potential data breaches. Attackers can use the information obtained through user enumeration to perform targeted attacks, such as brute-forcing passwords for known usernames.
To fix this vulnerability, it is recommended to upgrade Flask-AppBuilder to version 3.3.0 or higher. This upgrade includes the necessary fixes to prevent user enumeration.
While no specific workaround is mentioned for this vulnerability, implementing additional security measures like rate limiting or account lockouts can help mitigate the risk of brute-force attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for flask-appbuilder.
