Medium Severity

flask-cors

Regex Path Matching Vulnerability in CORS Policy

A vulnerability in version 4.0.1 of the flask-cors plugin allows less restrictive CORS policies to be applied to sensitive endpoints due to improper sorting of regex patterns. This issue was patched in a later version.

Available publicly on Aug 29 2024

4.3

CVSS:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Credit:

tomorroisnew
Threat Overview

The vulnerability arises from the plugin's incorrect prioritization of longer regex patterns over more specific ones when matching paths. This can result in less restrictive CORS policies being applied to endpoints that should be highly restricted. Consequently, unauthorized cross-origin access to sensitive data or functionality is possible, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.

Attack Scenario

An attacker can exploit this vulnerability by sending a request to a sensitive endpoint with a less restrictive CORS policy. For example, an attacker could send a request to /api/super_Secret from a malicious origin like https://evil.com, and due to the improper regex prioritization, the response would include the Access-Control-Allow-Origin header for the malicious origin, allowing unauthorized access to sensitive data.

Who is affected

Users of the flask-cors plugin version 4.0.1 who have configured CORS policies using regex patterns for path matching are affected. This includes developers and organizations that rely on flask-cors to manage cross-origin requests for their Flask applications.

Technical Report
Want more out of Sightline?

Sightline offers even more for premium customers

Go Premium

We have - related security advisories that are available with Sightline Premium.