CVE-2024-6844

Executive Summary

CVE-2024-6844 is a medium-severity vulnerability in the corydolphin/flask-cors Python library, version 4.0.1. The flaw arises from inconsistent CORS (Cross-Origin Resource Sharing) matching due to improper handling of the + character in URL paths. The request.path is passed through the unquote_plus function, which converts + to a space ( ). This leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.

Supply Chain & Package Security

This vulnerability affects the flask-cors Python package, which is widely used in Flask applications to handle CORS. The package is distributed via PyPI. Organizations using this library should verify their dependency versions and apply any available patches. The lack of a known patch increases the risk of supply chain attacks, as malicious actors could exploit this flaw in unpatched deployments.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The vulnerability allows an attacker to potentially bypass CORS restrictions, leading to unauthorized cross-origin requests. The integrity impact is low because the attacker can only manipulate CORS policy matching, not directly modify data.

Deep Dive & Mechanics

The core issue lies in the flask-cors library's handling of URL paths. When a request is received, the library uses unquote_plus to decode the URL path. This function converts + characters to spaces ( ). For example, a path like /api/v1/resource+ becomes /api/v1/resource . This transformation can cause the path to not match the expected CORS configuration patterns.

Consider a CORS configuration that allows cross-origin requests for /api/v1/resource. If an attacker sends a request to /api/v1/resource+, the library normalizes it to /api/v1/resource (with a trailing space). This may not match the configured pattern, leading to either:

• Bypass: The request is incorrectly allowed, enabling unauthorized cross-origin access.
• Block: A legitimate request is blocked, causing denial of service.

The vulnerability is particularly dangerous because it exploits a common URL encoding behavior, making it easy to exploit without sophisticated tools.

Vulnerable vs. Patched Code

Vulnerable Code (flask-cors 4.0.1):

from urllib.parse import unquote_plus

def match_path(request, config):
    path = unquote_plus(request.path)
    # ... matching logic using path

Patched Code (Hypothetical):

from urllib.parse import unquote

def match_path(request, config):
    path = unquote(request.path)  # Does not convert + to space
    # ... matching logic using path

The fix involves replacing unquote_plus with unquote to prevent the conversion of + to space. Alternatively, the library could normalize the path after decoding to remove trailing spaces.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install vulnerable flask-cors: pip install flask-cors==4.0.1

2. Create a simple Flask app with CORS configured for a specific path:

   from flask import Flask
   from flask_cors import CORS
   
   app = Flask(__name__)
   CORS(app, resources={r"/api/v1/resource": {"origins": "http://example.com"}})
   
   @app.route("/api/v1/resource")
   def resource():
       return "OK"
   

3. Run the app: python app.py

Exploitation:

• Send a request to /api/v1/resource+ from a different origin (e.g., http://attacker.com):

  curl -H "Origin: http://attacker.com" http://localhost:5000/api/v1/resource+
  

• Observe that the CORS headers may be incorrectly applied, allowing the request.

Blue Team

Detection:

• Monitor for requests containing + in URL paths, especially those targeting CORS-protected endpoints.
• Log and alert on any CORS policy mismatches or unexpected origin headers.

Mitigation:

• Apply input validation to reject or normalize paths with + characters.
• Use a Web Application Firewall (WAF) to block suspicious requests.

Indicators of Compromise (IOCs)

• URL Patterns: Requests containing + in the path, e.g., /api/v1/resource+
• HTTP Headers: Origin header from unexpected domains
• Log Entries: CORS policy mismatches or errors in application logs

Detection Engineering

YARA Rule

rule flask_cors_vuln {
    meta:
        description = "Detects vulnerable flask-cors version 4.0.1"
        author = "Valters IT"
        date = "2024-01-01"
    strings:
        $a = "flask-cors" nocase
        $b = "4.0.1" nocase
    condition:
        $a and $b
}

Sigma Rule

title: CVE-2024-6844 - Flask-Cors Path Normalization Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects requests with '+' in URL path targeting Flask applications using flask-cors
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: '+'
    condition: selection
falsepositives:
    - Legitimate use of '+' in URLs (e.g., search queries)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6844 - Flask-Cors Path Normalization Bypass"; flow:to_server; content:"+"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Update flask-cors to a patched version once available. Monitor the official repository for updates.
2. Workaround: Implement custom middleware to normalize URL paths before CORS processing:

   from urllib.parse import unquote
   
   @app.before_request
   def normalize_path():
       request.path = unquote(request.path)
   

3. WAF Rules: Block requests containing + in the path for sensitive endpoints.
4. Monitoring: Enable detailed logging for CORS-related events and alert on anomalies.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division.