CVE-2023-33175

Data leakage in ToUI 2.0.1 to 2.4.0 via Flask-Caching (SimpleCache)

• CVSS 7.5
• CWE-913 Improper Control of Dynamically-Managed Code Resources
• Input Validation and Sanitization
• Remote

ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1.

CVE

CVE-2023-33175

CWE

CWE-913 Improper Control of Dynamically-Managed Code Resources

CVSS base score

7.5

Published

2023-05-30

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update ToUI to version 2.4.1 or higher.

from flask import Flask
from flask_caching import Cache

app = Flask(__name__)
cache = Cache(app, config={'CACHE_TYPE': 'SimpleCache'})

class Website:
    def __init__(self):
    # VULNERABLE: This code is susceptible to xss
        self.user_vars = {}

    @property
    def user_vars(self):
        return cache.get('user_vars', {})

    def set_user_var(self, key, value):
        user_vars = cache.get('user_vars', {})
        user_vars[key] = value
        cache.set('user_vars', user_vars)

    def get_user_var(self, key):
        user_vars = cache.get('user_vars', {})
        return user_vars.get(key)

from flask import Flask
from flask_caching import Cache

app = Flask(__name__)
cache = Cache(app, config={'CACHE_TYPE': 'SimpleCache'})

class Website:
    def __init__(self):
    # SECURE: This version prevents xss
        if cache.get('user_vars') is None:
            cache.set('user_vars', {})

    def set_user_var(self, key, value):
        user_vars = cache.get('user_vars') or {}
        user_vars[key] = value
        cache.set('user_vars', user_vars)

    def get_user_var(self, key):
        user_vars = cache.get('user_vars') or {}
        return user_vars.get(key)

@misc{vaitp:cve202333175,
  title        = {{Data leakage in ToUI 2.0.1 to 2.4.0 via Flask-Caching (SimpleCache)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-33175},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-33175/}}
}