Executive brief
RansomLook is a web application for managing threat intelligence data. An administrative endpoint for creating cryptocurrency group entries was accessible without requiring login, allowing unauthenticated attackers to create, modify, or inject fraudulent data into the system that legitimate administrators should exclusively control.
Technical details
This is an authentication bypass vulnerability in the Flask web application routing. The /admin/crypto/group/new endpoint, which provides administrative functionality to create new crypto group entries, was not protected by Flask's login_required decorator. An unauthenticated remote attacker with network access to the RansomLook web interface could submit GET or POST requests to this endpoint and create or manipulate crypto group entries without possessing valid credentials. The vulnerability allows unauthorized data modification and could lead to integrity issues if malicious entries are subsequently consumed by other application logic. The fix applies the @flask_login.login_required decorator to enforce authentication checks.
Affected products
- RansomLook RansomLook
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Flask login_required decorator applied to /admin/crypto/group/new route