CVE-2021-21241
📋 TL;DR
This vulnerability in Flask-Security-Too allows attackers to steal authentication tokens via CSRF attacks on unprotected GET requests to /login and /change endpoints. It affects Flask applications using Flask-Security-Too versions 3.3.0 through 3.4.4. Attackers can use stolen tokens to impersonate authenticated users.
💻 Affected Systems
- Flask-Security-Too
📦 What is this software?
Flask Security Too by Flask Security Too Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal authentication tokens and gain full access to user accounts, potentially leading to data breaches, account takeover, and privilege escalation.
Likely Case
Attackers steal authentication tokens via malicious websites and perform unauthorized actions as authenticated users.
If Mitigated
With proper CSRF protection and token validation, attackers cannot steal tokens or misuse them.
🎯 Exploit Status
Exploitation requires user interaction (visiting malicious site) but is straightforward once token endpoints are identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.5 or 4.0.0
Vendor Advisory: https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv
Restart Required: Yes
Instructions:
1. Update Flask-Security-Too to version 3.4.5 or higher. 2. Run: pip install --upgrade Flask-Security-Too. 3. Restart your Flask application.
🔧 Temporary Workarounds
Disable authentication tokens
allSet SECURITY_TOKEN_MAX_AGE to 0 to make authentication tokens unusable if your application doesn't require them.
SECURITY_TOKEN_MAX_AGE = 0
🧯 If You Can't Patch
- Implement additional CSRF protection middleware for GET requests to /login and /change endpoints.
- Monitor logs for unusual GET requests to token endpoints and implement rate limiting.
🔍 How to Verify
Check if Vulnerable:
Check Flask-Security-Too version in requirements.txt or via pip show Flask-Security-Too. If version is between 3.3.0 and 3.4.4, you are vulnerable.Check Version:
pip show Flask-Security-Too | grep VersionVerify Fix Applied:
After updating, verify version is 3.4.5 or higher and test that GET requests to /login and /change no longer return authentication tokens.📡 Detection & Monitoring
Log Indicators:
- Multiple GET requests to /login or /change endpoints from suspicious sources
- Authentication token exposure in server logs
Network Indicators:
- CSRF attacks targeting token endpoints
- Unexpected token usage from new IP addresses
SIEM Query:
source="web_logs" AND (url_path="/login" OR url_path="/change") AND http_method="GET" AND status_code=200🔗 References
- https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f
- https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a
- https://github.com/Flask-Middleware/flask-security/pull/422
- https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5
- https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv
- https://pypi.org/project/Flask-Security-Too
- https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f
- https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a
- https://github.com/Flask-Middleware/flask-security/pull/422
- https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5
- https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv
- https://pypi.org/project/Flask-Security-Too
