Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-1681

CVE-2024-1681: flask-cors vulnerable to log injection when the log level is set to debug

5.3

CVSS Score
3.0

Basic Information

CVE ID
CVE-2024-1681
GHSA ID
GHSA-84pr-m4jr-85g5
EPSS Score
0.46945%
CWE
CWE-117
Published
4/19/2024
Updated
5/7/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
flask-corspip<= 4.0.04.0.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the LOG.debug() call in the cors_after_request handler, which directly logs the raw request.path value. Since request.path is user-controlled and contains CRLF sequences from malicious requests, it gets written to logs without sanitization. This matches the CWE-117 description and the advisory's mention of improper log output neutralization. The code snippet from extension.py line 194 context shows the vulnerable logging pattern.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ory*olp*in/*l*sk-*ors is vuln*r**l* to lo* inj**tion w**n t** lo* l*v*l is s*t to ***u*. *n *tt**k*r **n inj**t **k* lo* *ntri*s into t** lo* *il* *y s*n*in* * sp**i*lly *r**t** **T r*qu*st *ont*inin* * *RL* s*qu*n** in t** r*qu*st p*t*. T*is vuln*r

Reasoning

T** vuln*r**ility st*ms *rom t** LO*.***u*() **ll in t** *ors_**t*r_r*qu*st **n*l*r, w*i** *ir**tly lo*s t** r*w r*qu*st.p*t* v*lu*. Sin** r*qu*st.p*t* is us*r-*ontroll** *n* *ont*ins *RL* s*qu*n**s *rom m*li*ious r*qu*sts, it **ts writt*n to lo*s wi