CVE-2021-33026: Flask-Caching Remote Code Execution Vulnerability
Summary
PYSEC-2021-13: The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. Affects flask-caching versions >= 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask-Caching is an extension for Flask, a popular Python web framework. It provides caching functionality to improve the performance of Flask applications. The extension relies on Pickle for serialization, which is a vulnerability in this case. Pickle is a Python module used for object serialization and deserialization. However, it can be abused to execute arbitrary code if the attacker gains access to the cache storage. This vulnerability affects Flask-Caching versions up to 1.10.1.
Vulnerability Detail
The vulnerability in Flask-Caching arises from the use of Pickle for serialization. If an attacker gains access to the cache storage, they can construct a crafted payload and poison the cache. This allows them to execute arbitrary Python code, leading to remote code execution or local privilege escalation. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary code within the context of the Flask application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading Flask-Caching is not immediately feasible, a possible workaround is to disable caching or use an alternative caching mechanism that does not rely on Pickle for serialization. This can be achieved by configuring Flask to use a different caching backend, such as Redis or Memcached, which have built-in support for safe serialization. Here's an example of how to configure Flask to use Redis as the caching backend:
from flask import Flask
from flask_caching import Cache
app = Flask(__name__)
app.config['CACHE_TYPE'] = 'redis'
app.config['CACHE_REDIS_URL'] = 'redis://localhost:6379'
cache = Cache(app)
# Rest of the Flask application code
By using Redis as the caching backend, the vulnerability is mitigated as Redis uses a safe serialization method.
Conclusion
The Flask-Caching extension through version 1.10.1 is vulnerable to remote code execution or local privilege escalation due to its reliance on Pickle for serialization. Upgrading to version 1.10.2 or later is recommended to fix the vulnerability. Alternatively, disabling caching or using a different caching mechanism can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flask-caching →
FAQ
Flask-Caching is an extension for Flask that provides caching functionality to improve the performance of Flask applications.
Pickle is a Python module used for object serialization and deserialization. It is the serialization method used by Flask-Caching, which is vulnerable in this case.
Remote code execution refers to the ability of an attacker to execute arbitrary code on a remote system. In the case of this vulnerability, an attacker can execute Python code within the context of the Flask application.
To fix this vulnerability, it is recommended to upgrade Flask-Caching to version 1.10.2 or later.
A possible workaround is to disable caching or use an alternative caching mechanism that does not rely on Pickle for serialization. Configuring Flask to use a different caching backend, such as Redis or Memcached, can mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for flask-caching.
