Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update extension.py to clean request.path before logging it #351

Merged
merged 2 commits into from
May 4, 2024
Merged

Update extension.py to clean request.path before logging it #351

merged 2 commits into from
May 4, 2024

Conversation

aneshujevic
Copy link
Contributor

Hi @corydolphin

In this PR I've used Python's repr method to escape special characters and print them as ordinary characters as a bugfix for CVE-2024-1681 - https://nvd.nist.gov/vuln/detail/CVE-2024-1681.

This should resolve #349.

@andrew-womeldorf
Copy link

Confirmed that the exploit PoC is resolved with this patch

flask_cors/extension.py Outdated Show resolved Hide resolved
@corydolphin
Copy link
Owner

Thank you very much for the contribution and fixing this issue.

@corydolphin corydolphin merged commit 6172c20 into corydolphin:main May 4, 2024
emmeowzing referenced this pull request in premiscale/premiscale Jun 1, 2024
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [flask-cors](https://togithub.com/corydolphin/flask-cors) | `==3.0.10`
-> `==4.0.1` |
[![age](https://developer.mend.io/api/mc/badges/age/pypi/flask-cors/4.0.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/pypi/flask-cors/4.0.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/pypi/flask-cors/3.0.10/4.0.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/flask-cors/3.0.10/4.0.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

### GitHub Vulnerability Alerts

#### [CVE-2024-1681](https://nvd.nist.gov/vuln/detail/CVE-2024-1681)

corydolphin/flask-cors is vulnerable to log injection when the log level
is set to debug. An attacker can inject fake log entries into the log
file by sending a specially crafted GET request containing a CRLF
sequence in the request path. This vulnerability allows attackers to
corrupt log files, potentially covering tracks of other attacks,
confusing log post-processing tools, and forging log entries. The issue
is due to improper output neutralization for logs.

---

### Release Notes

<details>
<summary>corydolphin/flask-cors (flask-cors)</summary>

###
[`v4.0.1`](https://togithub.com/corydolphin/flask-cors/blob/HEAD/CHANGELOG.md#401)

[Compare
Source](https://togithub.com/corydolphin/flask-cors/compare/4.0.0...4.0.1)

##### Security

- Address
[CVE-2024-1681](https://togithub.com/advisories/GHSA-84pr-m4jr-85g5)
which is a log injection vulnerability when the log level is set to
debug by [@&#8203;aneshujevic](https://togithub.com/aneshujevic) in
[https://github.com/corydolphin/flask-cors/pull/351](https://togithub.com/corydolphin/flask-cors/pull/351)

###
[`v4.0.0`](https://togithub.com/corydolphin/flask-cors/blob/HEAD/CHANGELOG.md#400)

[Compare
Source](https://togithub.com/corydolphin/flask-cors/compare/3.0.10...4.0.0)

- Remove support for Python versions older than 3.8 by
[@&#8203;WAKayser](https://togithub.com/WAKayser) in
[https://github.com/corydolphin/flask-cors/pull/330](https://togithub.com/corydolphin/flask-cors/pull/330)
- Add GHA tooling by
[@&#8203;corydolphin](https://togithub.com/corydolphin) in
[https://github.com/corydolphin/flask-cors/pull/331](https://togithub.com/corydolphin/flask-cors/pull/331)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/premiscale/premiscale).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zNDAuMTAiLCJ1cGRhdGVkSW5WZXIiOiIzNy4zNzcuOCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

CVE-2024-1681 response/patching
4 participants