CVE-2021-21241: CSRF can expose users authentication token
(updated )
Issue
The /login and /change endpoints can return the authenticated user’s authentication token in response to a GET request. Since GET requests aren’t protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token.
Patches
Version 3.4.5 and soon to be released 4.0.0 are patched.
Workarounds
If you aren’t using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to “0” (seconds) which should make the token unusable.
References
None
References
- github.com/advisories/GHSA-hh7m-rx4f-4vpv
- github.com/pypa/advisory-database/tree/main/vulns/flask-security-too/PYSEC-2021-91.yaml
- nvd.nist.gov/vuln/detail/CVE-2021-21241
- pypi.org/project/Flask-Security-Too
- web.archive.org/web/20210118165844/https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5
- web.archive.org/web/20210118165958/https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a
- web.archive.org/web/20210118170445/https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f
- web.archive.org/web/20210118170502/https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv
- web.archive.org/web/20211207005640/https://github.com/Flask-Middleware/flask-security/pull/422
Code Behaviors & Features
Detect and mitigate CVE-2021-21241 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →