CVE-2023-29005
📋 TL;DR
Flask-AppBuilder versions before 4.3.0 lack built-in rate limiting for authentication endpoints, allowing attackers to perform unlimited brute-force attacks against user credentials. This affects all deployments using vulnerable versions of Flask-AppBuilder with authentication enabled.
💻 Affected Systems
- Flask-AppBuilder
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could brute-force administrator credentials, gain full system access, and compromise sensitive data or deploy ransomware.
Likely Case
Attackers brute-force user accounts to gain unauthorized access, potentially leading to data theft or privilege escalation.
If Mitigated
With rate limiting enabled, brute-force attempts are blocked after threshold, preventing credential compromise.
🎯 Exploit Status
No authentication required for login attempts. Simple tools like Hydra or Burp Intruder can exploit this.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.0 and later
Vendor Advisory: https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-9hcr-9hcv-x6pv
Restart Required: Yes
Instructions:
1. Upgrade to Flask-AppBuilder 4.3.0 or later. 2. Enable rate limiting by setting AUTH_RATE_LIMITED = True, RATELIMIT_ENABLED = True, and configuring AUTH_RATE_LIMIT. 3. Restart the application.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allConfigure WAF rules to limit authentication attempts per IP address.
Reverse Proxy Rate Limiting
linuxUse nginx or Apache to implement rate limiting at the proxy layer.
nginx example: limit_req_zone $binary_remote_addr zone=auth:10m rate=5r/m;
Add 'limit_req zone=auth burst=10 nodelay;' to auth location block
🧯 If You Can't Patch
- Implement network-level rate limiting using firewalls or load balancers.
- Enable account lockout policies after failed attempts if supported.
🔍 How to Verify
Check if Vulnerable:
Check Flask-AppBuilder version in requirements.txt or via pip show Flask-AppBuilder. If version < 4.3.0, check if AUTH_RATE_LIMITED and RATELIMIT_ENABLED are set to True in configuration.Check Version:
pip show Flask-AppBuilder | grep VersionVerify Fix Applied:
After upgrade, verify version is ≥4.3.0 and test authentication endpoint with rapid requests - should receive 429 Too Many Requests after limit.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts from same IP address
- Unusual high volume of POST requests to /login endpoint
Network Indicators:
- High volume of authentication requests
- Pattern of sequential username/password attempts
SIEM Query:
source="app.log" AND "POST /login" AND status=401 | stats count by src_ip | where count > 10🔗 References
- https://flask-limiter.readthedocs.io/en/stable/configuration.html
- https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-9hcr-9hcv-x6pv
- https://flask-limiter.readthedocs.io/en/stable/configuration.html
- https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-9hcr-9hcv-x6pv
