CVE-2021-21241 CSRF can expose users authentication token in Flask-Security-Too

2021-01-1120:35:16

CWE-352

GitHub_M

www.cve.org

flask-security-too

csrf

authentication token

workaround

patch

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

46.2%

JSON

The Python “Flask-Security-Too” package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user’s authentication token in response to a GET request. Since GET requests aren’t protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren’t using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to “0” (seconds) which should make the token unusable.

CNA Affected

[
  {
    "product": "flask-security-too",
    "vendor": "Flask-Middleware",
    "versions": [
      {
        "status": "affected",
        "version": ">= 3.3.0, < 3.4.5"
      }
    ]
  }
]