Vulnerability · Published Apr 19, 2024 · Assigned by @huntr_ai
CVE-2024-1681Log Injection Vulnerability in corydolphin/flask-cors
Medium 5.3
In plain English
A medium-severity security flaw in corydolphin/flask-cors from corydolphin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-flask-cors | 3.0.10-2+deb12u1 | DEBIAN-CVE-2024-1681 |
| Debian:13 | python-flask-cors | 4.0.1-1 | DEBIAN-CVE-2024-1681 |
| Debian:14 | python-flask-cors | 4.0.1-1 | DEBIAN-CVE-2024-1681 |
| PyPI | flask-cors | 4.0.1 | GHSA-84pr-m4jr-85g5 |
| PyPI | flask-cors | no fix listed | PYSEC-2024-271 |
| Ubuntu:22.04:LTS | python-flask-cors | 3.0.9-2ubuntu0.1 | USN-7612-1 |
| Ubuntu:22.04:LTS | python-flask-cors | 3.0.9-2ubuntu0.1 | UBUNTU-CVE-2024-1681 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| corydolphin | corydolphin/flask-cors | unspecified – through latest |
Weakness: CWE-117 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N