CVE-2024-1681: corydolphin flask-cors log injection in debug mode

Executive brief

A vulnerability in the flask-cors library, which manages Cross-Origin Resource Sharing (CORS) for Flask applications, allows attackers to inject fake entries into system logs. By sending specially crafted web requests, an attacker can create misleading log data to hide malicious activity or disrupt automated log monitoring tools. This issue primarily affects systems where debug-level logging is enabled.

Technical details

The flask-cors library (versions 4.0.0 and prior) is vulnerable to log injection (CWE-117) due to improper output neutralization of user-supplied input before it is written to logs. When the application's log level is set to DEBUG, an unauthenticated remote attacker can send a GET request containing Carriage Return and Line Feed (CRLF) sequences in the request path. This allows the attacker to terminate the current log line and start a new, forged entry. This can be used to bypass log integrity, mislead forensic investigations, or exploit vulnerabilities in log processing software. The issue is patched in version 4.0.1.

Affected products

• corydolphin flask-cors <= 4.0.0

Timeline

• 2024-04-19: disclosed
• 2024-04-19: advisory: GHSA-84pr-m4jr-85g5 published

References

• https://api.github.com/users/bayandin
• https://github.com/bayandin
• https://api.github.com/users/bayandin/gists%7B/gist_id%7D
• https://api.github.com/users/bayandin/repos
• https://avatars.githubusercontent.com/u/864213?v=4
• https://api.github.com/users/bayandin/events%7B/privacy%7D