Security features bypass in Flask-CORS - CVE-2024-6839

Vulnerability identifier: #VU112140

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-6839

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper regex path matching. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. A remote attacker can gain unauthorized cross-origin access to sensitive data or functionality.

Flask-CORS
IBM Cloud Pak for Data System
IBM Maximo Application Suite
watsonx.data
Maximo Application Suite - Visual Inspection Component
Ubuntu
openEuler
python-flask-cors (Ubuntu package)
python-Flask-Cors-help
python3-Flask-Cors
python-Flask-Cors

Install updates from vendor's website.

Flask-CORS - update to 6.0.0
IBM Cloud Pak for Data System - update to 1.0.10.0
watsonx.data - update to 2.3.1
Maximo Application Suite - Visual Inspection Component - update to 9.0.8
python-flask-cors (Ubuntu package) - addressed in versions 3.0.8-2ubuntu0.1+esm1, 3.0.9-2ubuntu0.1, 4.0.0-1ubuntu0.1~esm1, 4.0.1-1ubuntu0.1, 5.0.0-1ubuntu0.1
python-Flask-Cors-help - update to 6.0.1-1
python3-Flask-Cors - update to 6.0.1-1
python-Flask-Cors - update to 6.0.1-1
IBM Maximo Application Suite - addressed in versions 8.10.27, 8.11.24, 9.0.13, 9.1.1

• https://huntr.com/bounties/403eb1fc-86f4-4820-8eba-0f3dfae9f2b4
• https://github.com/corydolphin/flask-cors/releases/tag/6.0.0
• https://github.com/advisories/GHSA-7rxf-gvfg-47g4
• https://github.com/corydolphin/flask-cors/pull/391

• Multiple vulnerabilities in Flask-CORS
• Ubuntu update for python-flask-cors
• openEuler 24.03 LTS SP1 update for python-Flask-Cors
• openEuler 24.03 LTS update for python-Flask-Cors
• Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component
• Multiple vulnerabilities in IBM Maximo Application Suite
• openEuler 24.03 LTS SP2 update for python-Flask-Cors
• Multiple vulnerabilities in IBM Cloud Pak for Data System
• Multiple vulnerabilities in IBM watsonx.data