CyberSecBulletin
CVE-2023-30861NVD status: Modified

flask: Use of Persistent Cookies Containing Sensitive Information

Published Updated By the CyberSecBulletin desk

CVE-2023-30861 is a high-severity use of persistent cookies containing sensitive information vulnerability in flask from Pallets, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected flask versions: >= 2.3.0, < 2.3.2; < 2.2.5. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 1.25% chance of exploitation within 30 days, higher than 70% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Check which version of flask you run against the affected versions below, and install the vendor's latest release.
  2. Read the advisory on github.com for workarounds and exact fixed builds.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
Palletsflask>= 2.3.0, < 2.3.2; < 2.2.5Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.5HighCNA (github.com)
CVSS 3.17.5HighNVD

Official description

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use of Persistent Cookies Containing Sensitive Information

The web application uses persistent cookies, but the cookies contain sensitive information.

How developers prevent this class of flaw

  • Do not store sensitive information in persistent cookies.

More Use of Persistent Cookies Containing Sensitive Information vulnerabilities (CWE-539)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Spotted an error? Tell us.