CVE-2021-32838: Regular Expression Denial of Service in flask-restx
Summary
CVE-2021-32838: Regular Expression Denial of Service in flask-restx. Affects flask-restx versions < 0.5.1. Fixed in 0.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask-RESTX is a Python library that adds support for quickly building REST APIs. It provides a set of decorators and tools to define API endpoints, handle request parsing, and generate API documentation. The library is widely used in Python web development projects. However, it is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in the email_regex component.
Vulnerability Detail
The vulnerability in flask-restx arises from a regular expression pattern that is susceptible to ReDoS attacks. ReDoS attacks occur when a malicious user provides input that causes the regular expression engine to exhibit exponential time complexity. In this case, the email_regex pattern can be exploited by an attacker to cause a denial of service by providing a specially crafted email address. The attack can consume excessive CPU resources and potentially render the application unresponsive. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
0.5.1
This is the first release that contains the fix.
pip install --upgrade "flask-restx==0.5.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of flask-restx to mitigate the risk of ReDoS attacks.
Conclusion
Flask-RESTX is vulnerable to a Regular Expression Denial of Service (ReDoS) attack in the email_regex component. This vulnerability can be mitigated by updating to version 0.5.1 or later. It is recommended to promptly update the library to ensure the security and stability of your application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for flask-restx →
FAQ
Flask-RESTX is a Python library that simplifies the process of building REST APIs. It provides decorators and tools for defining API endpoints, handling request parsing, and generating API documentation.
A ReDoS (Regular Expression Denial of Service) attack occurs when a malicious user provides input that causes a regular expression pattern to exhibit exponential time complexity. This can lead to excessive CPU usage and denial of service.
The vulnerability in flask-restx can be exploited by an attacker to cause a denial of service by providing a specially crafted email address. This can result in excessive CPU usage and potentially render the application unresponsive.
To fix this vulnerability, update flask-restx to version 0.5.1 or later. This version includes a fix for the vulnerable regular expression pattern.
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of flask-restx to mitigate the risk of ReDoS attacks.
