Executive brief
Flask-AppBuilder is a Python library for rapidly building web applications with admin dashboards. An authenticated admin user could craft search queries to infer partial password hashes of other users when using database authentication, potentially revealing user credential patterns and linking hashes to specific accounts without direct exposure of the full hash values.
Technical details
The vulnerability is an information disclosure issue (CWE-200, CWE-916) in Flask-AppBuilder versions before 4.1.3 affecting only deployments using AUTH_DB (database) authentication. An authenticated admin user can craft HTTP requests with filter parameters to search for users by partial salted and hashed password strings. Although the HTTP response does not include the full hashed passwords, the success or failure of filter results allows an attacker to infer which partial password hashes correspond to which users. This requires admin-level authentication and is specific to database-backed authentication configurations. The vulnerability was patched in version 4.1.3.
Affected products
- Flask-AppBuilder Flask-AppBuilder before 4.1.3
Timeline
- 2022-07-29: disclosed
- 2022-07-29: patched: Fixed in version 4.1.3