CVE-2023-52289

Unauthenticated directory traversal in flaskcode (through 0.0.8) allows writing to arbitrary files via a POST request to a /update-resource-data/ URI

• CVSS 7.5
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a POST request to a /update-resource-data/ URI (from views.py), allows attackers to write to arbitrary files.

CVE

CVE-2023-52289

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

7.5

Published

2024-01-13

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update to flaskcode version 0.0.9 or higher

from flask import Flask, request

app = Flask(__name__)

@app.route('/update-resource-data/', methods=['POST'])
def update_resource_data():
    filename = request.form.get('filename')
    data = request.form.get('data')

    with open(filename, 'w') as f:
        f.write(data)

    return 'File updated successfully', 200

if __name__ == '__main__':
    app.run()

from flask import Flask, request, abort
import os

app = Flask(__name__)

SAFE_DIRECTORY = '/directory/'

@app.route('/update-resource-data/', methods=['POST'])
def update_resource_data():
    filename = request.form.get('filename')
    data = request.form.get('data')

    if '..' in filename or filename.startswith('/'):
        abort(400, 'Invalid filename')

    safe_path = os.path.join(SAFE_DIRECTORY, filename)

    with open(safe_path, 'w') as f:
        f.write(data)

    return 'File updated successfully', 200

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202352289,
  title        = {{Unauthenticated directory traversal in flaskcode (through 0.0.8) allows writing to arbitrary files via a POST request to a /update-resource-data/ URI}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-52289},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-52289/}}
}