CVE-2024-50647

Unauthorized access in python_food V1.0 leaks sensitive user information.

• CVSS 7.5
• CWE-863
• Information Leakage
• Remote

The python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user information. Attackers can access it through https://ip:port/api/myapp/index/user/info?id=1 And modify the ID value to obtain sensitive user information beyond authorization.

CVE

CVE-2024-50647

CWE

CWE-863

CVSS base score

7.5

Published

2024-11-15

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Information Leakage

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

python_food

Fixed by upgrading

Yes

Solution

Upgrade to python_food ordering system V1.1 and implement proper authorization checks for user information access.

from flask import Flask, request, jsonify

app = Flask(__name__)

users = {
    1: {"name": "Alice", "email": "alice@example.com"},
    2: {"name": "Bob", "email": "bob@example.com"},
}

@app.route('/api/myapp/index/user/info', methods=['GET'])
def get_user_info():
    user_id = request.args.get('id')
    user_info = users.get(int(user_id))
    if user_info:
        return jsonify(user_info)
    else:
        return jsonify({"error": "User  not found"}), 404

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000)

from flask import Flask, request, jsonify, abort

app = Flask(__name__)

users = {
    1: {"name": "Alice", "email": "alice@example.com"},
    2: {"name": "Bob", "email": "bob@example.com"},
}

def is_authorized(user_id):
    return user_id == 1

@app.route('/api/myapp/index/user/info', methods=['GET'])
def get_user_info():
    user_id = request.args.get('id', type=int)

    if user_id is None or not is_authorized(user_id):
        abort(403)

    user_info = users.get(user_id)
    if user_info is None:
        abort(404)

    return jsonify(user_info)

if __name__ == '__main__':
    app.run(debug=True, host='0.0.0.0', port=5000)

@misc{vaitp:cve202450647,
  title        = {{Unauthorized access in python_food V1.0 leaks sensitive user information.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-50647},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-50647/}}
}