CVE-2022-30034
📋 TL;DR
CVE-2022-30034 is an OAuth authentication bypass vulnerability in Flower, the web UI for Celery Python RPC framework. This allows attackers to bypass authentication and access the Flower API to discover and invoke arbitrary Celery RPC calls or shut down task nodes, potentially leading to remote code execution or denial of service. All Flower installations as of May 2, 2022 are affected.
💻 Affected Systems
- Flower (Celery monitoring tool)
📦 What is this software?
Flower by Flower Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full control over Celery infrastructure, execute arbitrary code through RPC calls, exfiltrate sensitive data, and cause complete service disruption by shutting down all task nodes.
Likely Case
Unauthorized access to Flower dashboard, discovery of internal task workflows, potential data exposure from task results, and targeted denial of service against specific Celery nodes.
If Mitigated
Limited impact with proper network segmentation and authentication controls, though the vulnerability still exists in the application layer.
🎯 Exploit Status
Public exploit details available in GitHub issues and security write-ups. Exploitation requires network access to Flower instance but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.2.0 and later
Vendor Advisory: https://github.com/mher/flower/issues/1217
Restart Required: Yes
Instructions:
1. Upgrade Flower to version 1.2.0 or later using pip: 'pip install --upgrade flower>=1.2.0'. 2. Restart the Flower service. 3. Verify OAuth configuration is properly secured.
🔧 Temporary Workarounds
Disable OAuth Authentication
allTemporarily disable OAuth authentication and use alternative authentication methods or restrict access
Configure Flower without OAuth: remove or comment OAuth settings in flower configuration
Network Access Restriction
linuxRestrict network access to Flower instance using firewall rules
iptables -A INPUT -p tcp --dport 5555 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 5555 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation: Place Flower behind VPN or internal network with no internet exposure
- Deploy Web Application Firewall (WAF) with rules to block unauthorized API access patterns
🔍 How to Verify
Check if Vulnerable:
Check Flower version: if version < 1.2.0 and OAuth is enabled, the system is vulnerable. Also check if unauthorized API access is possible without valid OAuth tokens.Check Version:
flower --version # or check pip list: pip show flower | grep VersionVerify Fix Applied:
Verify Flower version is 1.2.0 or higher: 'flower --version'. Test that OAuth authentication properly rejects unauthorized requests.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to Flower API endpoints
- OAuth authentication failures followed by successful API calls
- Unusual RPC task invocations from unknown sources
Network Indicators:
- HTTP requests to Flower API endpoints without proper authentication headers
- Unusual traffic patterns to Flower port (default 5555) from unexpected sources
SIEM Query:
source="flower.log" AND ("401" OR "403") AND ("POST /api" OR "GET /api") | stats count by src_ip