CVE-2023-30861 Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header
Attackers can steal session cookies via caching proxies if Flask sessions are permanent and not accessed, leading to potential account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-30861?
CVE-2023-30861 is a high-severity vulnerability in pallets flask, published on 2 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.
1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.
This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.
Weakness: CWE-539
Which versions are affected by CVE-2023-30861?
5 open source packages ship an affected version, including flask and Flask. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
flask PyPI | All versions | 2.2.5, 2.3.2 |
flask PyPI | All versions | 2.2.5 |
flask PyPI | From 2.3.0 | 2.3.2 |
Flask PyPI | All versions | 2.2.5 |
Flask PyPI | From 2.3.0 | 2.3.2 |
Linux distribution packages (29)
python-flask Red Hat:openstack:16.1::el8 | All versions | 1:1.0.2-8.el8ost |
python3-flask Red Hat:openstack:16.1::el8 | All versions | 1:1.0.2-8.el8ost |
python-flask Red Hat:openstack:16.2::el8 | All versions | 1:1.0.2-8.el8ost |
python3-flask Red Hat:openstack:16.2::el8 | All versions | 1:1.0.2-8.el8ost |
python-flask Red Hat:openstack:17.0::el9 | All versions | 1:1.1.2-6.el9ost |
python3-flask Red Hat:openstack:17.0::el9 | All versions | 1:1.1.2-6.el9ost |
python-flask Red Hat:rhel_extras_other:7 | All versions | 1:0.10.1-7.el7_9 |
python-Flask SUSE:Enterprise Storage 7 | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Enterprise Storage 7.1 | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 1.0.4-150400.3.3.1 |
python-Flask SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 1.0.4-150400.3.3.1 |
python-Flask SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Linux Enterprise Module for Package Hub 15 SP5 | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Linux Enterprise Real Time 15 SP3 | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Manager Proxy 4.2 | All versions | 1.0.2-150100.6.3.1 |
python-Flask SUSE:Manager Server 4.2 | All versions | 1.0.2-150100.6.3.1 |
python-Flask openSUSE:Leap 15.4 | All versions | 1.0.4-150400.3.3.1 |
python-Flask openSUSE:Leap 15.5 | All versions | 1.0.4-150400.3.3.1 |
python-Flask openSUSE:Tumbleweed | All versions | 3.1.3-3.1 |
Products include Palletsprojects Flask.
How do I fix CVE-2023-30861?
Upgrade flask to a fixed version for your release line: 2.2.5 or 2.3.2.
Is CVE-2023-30861 being exploited?
There is no known exploitation of CVE-2023-30861 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in pallets flask
Sources
Also known as AZL-43798, AZL-44718, CLSA-2026-1772410250, CLSA-2026-1772410251, DEBIAN-CVE-2023-30861, DLA-3536-1 and 18 more.