Flask-AppBuilder Vulnerability Allows Attacker to Forgery HTTP Requests and Grant Unauthorized Access

CVE-2024-25128

What is CVE-2024-25128?

Flask-AppBuilder, an application development framework based on Flask, has a vulnerability allowing attackers to manipulate HTTP requests. When configured with AUTH_TYPE set to AUTH_OID, an attacker can exploit this flaw to trick the backend into authenticating using a malicious OpenID service. This scenario arises from the application's reliance on the OpenID 2.0 authorization protocol. If an attacker has control over a custom OpenID service, they can gain unauthorized privilege access. It is advised to upgrade to Flask-AppBuilder version 4.3.11 or later to mitigate this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References