CVE-2021-21241 CSRF can expose users authentication token in Flask-Security-Too
Attackers can steal authentication tokens via CSRF on GET endpoints, potentially taking over user accounts in Flask applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21241?
CVE-2021-21241 is a high-severity vulnerability in Flask-Middleware flask-security-too, published on 11 Jan 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
Weakness: CWE-352
Which versions are affected by CVE-2021-21241?
3 open source packages ship an affected version, including flask-security-too and Flask-Security-Too. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
flask-security-too PyPI | From 3.3.0 | 3.4.5 |
flask-security-too PyPI | From 3.3.0 | 3.4.5 |
Flask-Security-Too PyPI | From 3.3.0 | 3.4.5 |
Linux distribution packages (13)
python-Flask-Security-Too SUSE:Enterprise Storage 7 | All versions | 3.4.2-150200.3.3.1 |
python-Flask-Security-Too SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 3.4.2-150200.3.3.1 |
python-Flask-Security-Too SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 3.4.2-150200.3.3.1 |
python-Flask-Security-Too SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 3.4.2-150200.3.3.1 |
python-Flask-Security-Too SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 3.4.2-150200.3.3.1 |
python-Flask-Security-Too SUSE:Linux Enterprise Server 15 SP2-BCL | All versions | 3.4.2-150200.3.3.1 |
python-Flask-Security-Too SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 3.4.2-150200.3.3.1 |
python-Flask-Security-Too SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 3.4.2-150200.3.3.1 |
python-Flask-Security-Too SUSE:Manager Proxy 4.1 | All versions | 3.4.2-150200.3.3.1 |
python-Flask-Security-Too SUSE:Manager Retail Branch Server 4.1 | All versions | 3.4.2-150200.3.3.1 |
python-Flask-Security-Too SUSE:Manager Server 4.1 | All versions | 3.4.2-150200.3.3.1 |
python-Flask-Security-Too openSUSE:Leap 15.3 | All versions | 3.4.2-150200.3.3.1 |
python-Flask-Security-Too openSUSE:Leap 15.4 | All versions | 3.4.2-150200.3.3.1 |
Products include Flask-Security-Too Project Flask-Security-Too.
How do I fix CVE-2021-21241?
Upgrade flask-security-too to 3.4.5 or later.
Is CVE-2021-21241 being exploited?
There is no known exploitation of CVE-2021-21241 in the wild and no public exploit code.
Other vulnerabilities in Flask-Middleware flask-security-too
Sources
Also known as DEBIAN-CVE-2021-21241, GHSA-hh7m-rx4f-4vpv, PYSEC-2021-91, SUSE-SU-2022:3093-1.