CVE-2021-33026: Deserialization of Untrusted Data in Flask-Caching
Summary
CVE-2021-33026: Deserialization of Untrusted Data in Flask-Caching. Affects flask-caching versions < 1.10.1. No fix is published. How to fix ↓
Also tracked for
- flask-caching · Debian:11
The same CVE-2021-33026 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask-Cache is an extension for Flask that provides easy cache support. It allows Flask applications to store and retrieve data from various cache storage systems such as filesystem, Memcached, Redis, etc. Flask-Cache relies on Pickle for serialization, which is a vulnerability in this case.
Vulnerability Detail
The Flask-Caching extension through version 1.10.1 for Flask is vulnerable to deserialization of untrusted data. This vulnerability arises from the use of Pickle for serialization, which can lead to remote code execution or local privilege escalation. An attacker who gains access to the cache storage can construct a crafted payload, poison the cache, and execute arbitrary Python code. However, this vulnerability requires specific conditions to be met, including the ability to write arbitrary values to the cache, generate a cache key that collides with a value being read by the application, and cause the application to read the maliciously-injected value. It is important to note that if an attacker can inject malicious cached rendered pages into a Flask app's cache, they can manipulate the website's content regardless of remote code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is advised to update the Flask-Caching package to the latest version as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Flask-Caching (CVE-2021-33026) can lead to remote code execution or local privilege escalation. It is crucial to update the Flask-Caching package to version 1.10.2 or later to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for flask-caching →
FAQ
Flask-Cache is an extension for Flask that adds cache support to Flask applications. It allows developers to store and retrieve data from various cache storage systems.
The vulnerability in Flask-Caching can lead to remote code execution or local privilege escalation. An attacker who gains access to the cache storage can execute arbitrary Python code.
To exploit this vulnerability, an attacker must be able to write arbitrary values to the cache, generate a cache key that collides with a value being read by the application, and cause the application to read the maliciously-injected value.
No, this vulnerability is classified as moderate severity. It requires specific conditions to be met, and if those conditions are already present, the application may have larger security issues.
To mitigate the risk, it is recommended to update Flask-Caching to version 1.10.2 or later. This updated version implements secure serialization methods that do not rely on Pickle.
References
Related vulnerabilities
Recent vulnerabilities recorded for flask-caching.
