CVE-2024-50650

Incorrect Access Control in python_book V1.0 allows ID parameter manipulation.

• CVSS 7.5
• CWE-863
• Authentication, Authorization, and Session Management
• Remote

python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter.

CVE

CVE-2024-50650

CWE

CWE-863

CVSS base score

7.5

Published

2024-11-15

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Authentication, Authorization, and Session Management

Subcategory

Insecure Direct Object References (IDOR)

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

python_book

Fixed by upgrading

Yes

Solution

Upgrade to python_book V1.1 and implement proper access control checks for ID parameters.

from flask import Flask, request, jsonify

app = Flask(__name__)

users = {
    1: {"name": "Alice", "sensitive_info": "alice_secret"},
    2: {"name": "Bob", "sensitive_info": "bob_secret"},
}

@app.route('/user/<int:user_id>', methods=['GET'])
def get_user_info(user_id):
    # VULNERABLE: This code is susceptible to deserialization
    user_info = users.get(user_id)
    if user_info:
        return jsonify(user_info)
    else:
        return jsonify({"error": "User  not found"}), 404

if __name__ == '__main__':
    app.run()

from flask import Flask, request, abort, jsonify

app = Flask(__name__)

users = {
    1: {"name": "Alice", "sensitive_info": "alice_secret"},
    2: {"name": "Bob", "sensitive_info": "bob_secret"},
}

current_user_id = 1

@app.route('/user/<int:user_id>', methods=['GET'])
def get_user_info(user_id):
    # SECURE: This version prevents deserialization
    if user_id != current_user_id:
        abort(403)

    user_info = users.get(user_id)
    if user_info:
        return jsonify(user_info)
    else:
        abort(404)

if __name__ == '__main__':
    app.run()

GET /user/2 HTTP/1.1
Host: example.com

@misc{vaitp:cve202450650,
  title        = {{Incorrect Access Control in python_book V1.0 allows ID parameter manipulation.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-50650},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-50650/}}
}