CVE-2014-125028

Cross-Site Request Forgery in valtech IDP Test Client via python-flask/main.py (VDB-217148)

• CVSS 8.8
• CWE-352 Cross-Site Request Forgery (CSRF)
• Configuration Issues
• Remote

A vulnerability was found in valtech IDP Test Client and classified as problematic. Affected by this issue is some unknown functionality of the file python-flask/main.py. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The name of the patch is f1e7b3d431c8681ec46445557125890c14fa295f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217148.

CVE

CVE-2014-125028

CWE

CWE-352 Cross-Site Request Forgery (CSRF)

CVSS base score

8.8

Published

2022-12-31

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Configuration Issues

Subcategory

Cross-Site Request Forgery (CSRF)

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update valtech IDP Test Client to version containing patch f1e7b3d431c8681ec46445557125890c14fa295f.

from flask import Flask, request, redirect, url_for

app = Flask(__name__)
app.secret_key = 'your_secret_key'

@app.route('/submit', methods=['POST'])
def submit():
    return redirect(url_for('success'))

@app.route('/success')
def success():
    return "Form submitted successfully!"

if __name__ == '__main__':
    app.run()

from flask import Flask, request, redirect, url_for, session
from flask_wtf.csrf import CSRFProtect

app = Flask(__name__)
app.secret_key = 'your_secret_key'
csrf = CSRFProtect(app)

@app.route('/submit', methods=['POST'])
@csrf.exempt
def submit():
    return redirect(url_for('success'))

@app.route('/success')
def success():
    return "Form submitted successfully!"

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve2014125028,
  title        = {{Cross-Site Request Forgery in valtech IDP Test Client via python-flask/main.py (VDB-217148)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2014-125028},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2014-125028/}}
}