CVE-2022-30034
Flower (Celery web UI) OAuth bypass vulnerability
- CVSS 8.6
- CWE-287 Improper Authentication
- Authentication, Authorization, and Session Management
- Remote
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.
- CVSS base score
- 8.6
- Published
- 2022-06-02
- OWASP
- A07 Identification and Authentication Failures
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Authentication, Authorization, and Session Management
- Subcategory
- Insecure Authentication Mechanisms
- Accessibility scope
- Remote
- Impact
- Unauthorized Access
- Fixed by upgrading
- Yes
Solution
Update Flower to a version that fixes the OAuth authentication bypass vulnerability.
Vulnerable code sample
from flask import Flask, request
app = Flask(__name__)
@app.route('/api/celery/tasks', methods=['GET'])
def list_tasks():
return {"tasks": ["task1", "task2"]}
@app.route('/api/celery/execute', methods=['POST'])
def execute_task():
task_name = request.json.get('task_name')
return {"status": f"task {task_name} executed"}
if __name__ == '__main__':
app.run()Patched code sample
from flask import Flask, request, jsonify
import re
app = Flask(__name__)
ALLOWED_TASKS = ["task1", "task2"]
def is_valid_task_name(task_name):
return bool(re.match(r'^[a-zA-Z0-9_]+$', task_name))
@app.route('/api/celery/tasks', methods=['GET'])
def list_tasks():
return jsonify({"tasks": ALLOWED_TASKS})
@app.route('/api/celery/execute', methods=['POST'])
def execute_task():
if not request.is_json:
return jsonify({"error": "Invalid input format"}), 400
task_name = request.json.get('task_name')
if not task_name:
return jsonify({"error": "Missing task_name parameter"}), 400
if task_name not in ALLOWED_TASKS:
return jsonify({"error": "Unauthorized task"}), 403
if not is_valid_task_name(task_name):
return jsonify({"error": "Invalid task name format"}), 400
return jsonify({"status": f"task {task_name} executed"})
if __name__ == '__main__':
app.run(debug=False)Cite this entry
@misc{vaitp:cve202230034,
title = {{Flower (Celery web UI) OAuth bypass vulnerability}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2022},
note = {VAITP Python Vulnerability Dataset, entry CVE-2022-30034},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-30034/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::