CVE-2024-1681: flask-cors vulnerable to log injection when the log level is set to debug
(updated )
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
References
- github.com/advisories/GHSA-84pr-m4jr-85g5
- github.com/corydolphin/flask-cors/blob/40acc8092332dfed4bb54d7a4f89a6d479466de7/flask_cors/extension.py
- github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-271.yaml
- huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644
- lists.debian.org/debian-lts-announce/2025/05/msg00049.html
- nvd.nist.gov/vuln/detail/CVE-2024-1681
Code Behaviors & Features
Detect and mitigate CVE-2024-1681 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →