Executive brief
Flask-AppBuilder is a Python framework for rapidly building web applications on top of Flask. The database authentication login page contains an open redirect vulnerability that allows an attacker to redirect users to arbitrary external websites. An attacker could craft a malicious link to trick users into visiting phishing pages or other untrusted sites, compromising user credentials or spreading malware.
Technical details
Flask-AppBuilder versions prior to 3.4.5 contain a CWE-601 open redirect vulnerability in the database authentication login page. The application accepts user-controlled input that specifies a redirect URL and uses it without proper validation or sanitization. The vulnerability is exploitable via the network with no authentication required, but user interaction is necessary (user must click a crafted link). An attacker can redirect authenticated users to an untrusted external site. The fix is available in version 3.4.5 and later.
Affected products
- Flask-AppBuilder Flask-AppBuilder before 3.4.5
Timeline
- 2022-03-24: disclosed: Security advisory published
- 2022-03-25: patched: Version 3.4.5 released with fix