Is CVE-2024-1681 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-1681 being exploited in the wild.

How severe is CVE-2024-1681?

Medium severity, with a CVSS score of 5.3, published 19 April 2024.

Which products and versions are affected?

Flask-Cors (PyPI) <= 4.0.0, ECOSYSTEM:introduced=0,fixed=4.0.1, ECOSYSTEM:introduced=0,last_affected=4.0.0.

Is there a fix for CVE-2024-1681?

Yes. Flask-Cors (PyPI): upgrade to 4.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-1681 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-1681?

Check whether you run Flask-Cors (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-1681: corydolphin flask-cors log injection in debug mode

Q: Which products and versions are affected?

Flask-Cors (PyPI) <= 4.0.0, ECOSYSTEM:introduced=0,fixed=4.0.1, ECOSYSTEM:introduced=0,last_affected=4.0.0.

Q: Is there a fix for CVE-2024-1681?

Yes. Flask-Cors (PyPI): upgrade to 4.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-1681 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2024-1681?

Check whether you run Flask-Cors (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-1681 · Severity: medium · CVSS 5.3 · Published 2024-04-19

A vulnerability in the flask-cors library, which manages Cross-Origin Resource Sharing (CORS) for Flask applications, allows attackers to inject fake entries into system logs. By sending specially crafted web requests, an attacker can create misleading log data to hide malicious activity or disrupt automated log monitoring tools. This issue primarily affects systems where debug-level logging is enabled.

Technologies: Flask-Cors (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-1681 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-1681 being exploited in the wild.
How severe is CVE-2024-1681?: Medium severity, with a CVSS score of 5.3, published 19 April 2024.
Which products and versions are affected?: Flask-Cors (PyPI) <= 4.0.0, ECOSYSTEM:introduced=0,fixed=4.0.1, ECOSYSTEM:introduced=0,last_affected=4.0.0.
Is there a fix for CVE-2024-1681?: Yes. Flask-Cors (PyPI): upgrade to 4.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-1681 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-1681?: Check whether you run Flask-Cors (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Flask-Cors (PyPI): upgrade to 4.0.1 or later
```
pip install "Flask-Cors>=4.0.1"
```

Technical details

The flask-cors library (versions 4.0.0 and prior) is vulnerable to log injection (CWE-117) due to improper output neutralization of user-supplied input before it is written to logs. When the application's log level is set to DEBUG, an unauthenticated remote attacker can send a GET request containing Carriage Return and Line Feed (CRLF) sequences in the request path. This allows the attacker to terminate the current log line and start a new, forged entry. This can be used to bypass log integrity, mislead forensic investigations, or exploit vulnerabilities in log processing software. The issue is patched in version 4.0.1.

Affected products

corydolphin flask-cors <= 4.0.0

Identifiers

CVE-2024-1681
GHSA-84pr-m4jr-85g5
PYSEC-2024-271

Timeline

2024-04-19: disclosed
2024-04-19: advisory: GHSA-84pr-m4jr-85g5 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.