AIKIDO-2024-10084
Flask-Cors is vulnerable to Improper Output Neutralization for Logs (Log Injection)
50
Medium Risk
This Affects:
Flask-CorsTL;DR
Affected versions of the Flask-Cors library are vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue arises from improper output neutralization for logs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
Flask-Cors is vulnerable to Improper Output Neutralization for Logs (Log Injection) in versions 2.0.0 - 4.0.0.
How to fix this
Upgrade the Flask-Cors library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant