CVE-2022-31177

Flask-AppBuilder < 4.1.3: Admin user password query issue

• CVSS 2.7
• CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
• Input Validation and Sanitization
• Remote

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. This issue has been fixed in version 4.1.3. Users are advised to upgrade. There are no known workarounds for this issue.

CVE

CVE-2022-31177

CWE

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSS base score

2.7

Published

2022-08-01

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update Flask-AppBuilder to version 4.1.3 or higher.

@app.route('/users', methods=['GET'])
@admin_required
def get_users():
    password_filter = request.args.get('password')
    users = User.query.filter(User.password_hash.like(f'%{password_filter}%')).all()
    return jsonify([user.username for user in users])

from flask import abort

@app.route('/users', methods=['GET'])
@admin_required
def get_users():
    if 'password' in request.args:
        abort(400, description="Filtering by password is not allowed.")

    users = User.query.all()
    return jsonify([user.username for user in users])

@misc{vaitp:cve202231177,
  title        = {{Flask-AppBuilder < 4.1.3: Admin user password query issue}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-31177},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-31177/}}
}