CVE-2024-1681: Log Injection Vulnerability in corydolphin/flask-cors
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1681?
CVE-2024-1681 is classified as a moderate severity vulnerability due to its potential for log injection.
How do I fix CVE-2024-1681?
To fix CVE-2024-1681, upgrade flask-cors to version 4.0.1 or later.
Who is affected by CVE-2024-1681?
CVE-2024-1681 affects users of flask-cors versions up to and including 4.0.0.
What type of vulnerability is CVE-2024-1681?
CVE-2024-1681 is a log injection vulnerability that can be exploited through specially crafted GET requests.
What can attackers achieve with CVE-2024-1681?
Attackers can inject fake log entries into the log file, potentially leading to log corruption.