Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header
CVE-2023-30861

7.5HIGH

Key Information:

Vendor: Pallets
Status: Flask
Vendor: CVE Published:; 2 May 2023

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A vulnerability in the Flask framework allows for session data to be improperly cached by proxies, potentially exposing sensitive session cookies to unintended clients. This occurs when certain conditions are met: the application must be behind a caching proxy that fails to strip cookies, use permanent sessions without session access or modification during requests, and lack appropriate caching headers. This misconfiguration can lead to the proxy serving a client's session cookie to others, thus compromising user sessions. The issue has been addressed in Flask versions 2.2.5 and 2.3.2.

Affected Version(s)

flask >= 2.3.0, < 2.3.2 < 2.3.0, 2.3.2

flask < 2.2.5 < 2.2.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve-2023-30861-poc
Created by fromitive