Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header
CVE-2023-30861
Key Information:
Badges
What is CVE-2023-30861?
A vulnerability in the Flask framework allows for session data to be improperly cached by proxies, potentially exposing sensitive session cookies to unintended clients. This occurs when certain conditions are met: the application must be behind a caching proxy that fails to strip cookies, use permanent sessions without session access or modification during requests, and lack appropriate caching headers. This misconfiguration can lead to the proxy serving a client's session cookie to others, thus compromising user sessions. The issue has been addressed in Flask versions 2.2.5 and 2.3.2.
Affected Version(s)
flask >= 2.3.0, < 2.3.2 < 2.3.0, 2.3.2
flask < 2.2.5 < 2.2.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.