CVE-2023-52288

Unauthenticated directory traversal in flaskcode (through 0.0.8) allows reading arbitrary files via a GET request to a /resource-data/.txt URI

• CVSS 7.5
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a GET request to a /resource-data/.txt URI (from views.py), allows attackers to read arbitrary files.

CVE

CVE-2023-52288

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

7.5

Published

2024-01-13

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update to flaskcode version 0.0.9 or higher

from flask import Flask, send_file

app = Flask(__name__)

@app.route('/resource-data/<path:filename>.txt', methods=['GET'])
def get_resource_data(filename):
    file_path = f'./{filename}.txt'
    return send_file(file_path)

if __name__ == '__main__':
    app.run()

from flask import Flask, send_file, abort
import os

app = Flask(__name__)

BASE_DIR = '/base/directory'

@app.route('/resource-data/<path:filename>.txt', methods=['GET'])
def get_resource_data(filename):
    base_filename = os.path.basename(filename)
    file_path = os.path.join(BASE_DIR, base_filename + '.txt')

    if os.path.isfile(file_path):
        return send_file(file_path)
    else:
        abort(404)

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202352288,
  title        = {{Unauthenticated directory traversal in flaskcode (through 0.0.8) allows reading arbitrary files via a GET request to a /resource-data/.txt URI}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-52288},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-52288/}}
}