CVE-2024-1681 Log Injection Vulnerability in corydolphin/flask-cors
Attackers can inject fake log entries via CRLF sequences in request paths when debug logging is enabled, corrupting logs and hiding malicious activity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-1681?
CVE-2024-1681 is a medium-severity vulnerability in corydolphin/flask-cors, published on 19 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
Weakness: CWE-117
Which versions are affected by CVE-2024-1681?
3 open source packages ship an affected version, including flask-cors. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
flask-cors PyPI | All versions to 4.0.0 | None |
flask-cors PyPI | All versions | 4.0.1 |
flask-cors PyPI | All versions | 4.0.1 |
Linux distribution packages (1)
python-Flask-Cors openSUSE:Tumbleweed | All versions | 4.0.1-1.1 |
Products include Corydolphin Flask-Cors.
How do I fix CVE-2024-1681?
Upgrade flask-cors to 4.0.1 or later.
Is CVE-2024-1681 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1681 exists.
Other vulnerabilities in corydolphin/flask-cors
Sources
Also known as DEBIAN-CVE-2024-1681, GHSA-84pr-m4jr-85g5, OESA-2024-1713, PYSEC-2024-271, ROOT-APP-PYPI-CVE-2024-1681, UBUNTU-CVE-2024-1681 and 1 more.