CVE-2023-30861 – This vulnerability in Flask allows session cook... (How to Fix)

Q: What is the severity of CVE-2023-30861?

CVE-2023-30861 has a CVSS score of 7.5 (HIGH). This vulnerability in Flask allows session cookie leakage when specific conditions are met with caching proxies. It affects Flask applications hosted behind proxies that cache responses with Set-Cookie headers, potentially exposing one user's session to other users.

📋 TL;DR

This vulnerability in Flask allows session cookie leakage when specific conditions are met with caching proxies. It affects Flask applications hosted behind proxies that cache responses with Set-Cookie headers, potentially exposing one user's session to other users.

💻 Affected Systems

Products:

Flask

Versions: Flask versions before 2.2.5 and 2.3.2

Operating Systems: All

Default Config Vulnerable: ✅ No

Notes: Requires specific application configuration: session.permanent = True, SESSION_REFRESH_EACH_REQUEST enabled (default), no session access/modification during request, no Cache-Control headers, and vulnerable caching proxy configuration.

📦 What is this software?

Flask by Palletsprojects

View all CVEs affecting Flask →

Flask by Palletsprojects

View all CVEs affecting Flask →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Session hijacking where an attacker gains access to another user's authenticated session, potentially leading to account takeover and data compromise.

🟠

Likely Case

Limited session exposure affecting small subsets of users sharing the same proxy cache, with impact depending on application's session usage.

🟢

If Mitigated

No impact if any of the required conditions are not met or proper cache controls are implemented.

🌐 Internet-Facing: MEDIUM - Requires specific proxy configuration and application settings, but internet-facing applications are more likely to use caching proxies.

🏢 Internal Only: LOW - Internal applications less likely to use aggressive caching proxies with cookie retention.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires specific application and proxy configurations, making automated exploitation challenging but possible with reconnaissance.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.2.5 or 2.3.2

Vendor Advisory: https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq

Restart Required: Yes

Instructions:

1. Update Flask using pip: 'pip install --upgrade flask>=2.2.5' or 'pip install --upgrade flask>=2.3.2'. 2. Restart your Flask application. 3. Verify the update with 'pip show flask'.

🔧 Temporary Workarounds

Add Cache-Control headers

all

Add Cache-Control: private, no-store headers to responses to prevent proxy caching.

from flask import make_response
@app.after_request
def add_header(response):
    response.headers['Cache-Control'] = 'private, no-store'
    return response

Disable session refresh

all

Set SESSION_REFRESH_EACH_REQUEST = False to prevent session refresh without access.

app.config['SESSION_REFRESH_EACH_REQUEST'] = False

Access session in every request

all

Ensure session is accessed or modified in every request handler.

@app.before_request
def touch_session():
    session.modified = True

🧯 If You Can't Patch

Configure caching proxies to strip Set-Cookie headers or ignore responses with cookies
Implement application-level cache busting with unique identifiers in URLs or headers

🔍 How to Verify

Check if Vulnerable:

Check Flask version and application configuration for the five conditions listed in the CVE description.

Check Version:

pip show flask | grep Version

Verify Fix Applied:

Verify Flask version is 2.2.5+ or 2.3.2+ and test that Vary: Cookie header is set even when session is only refreshed.

📡 Detection & Monitoring

Log Indicators:

Multiple users receiving same session IDs
Unexpected cache hits for authenticated content

Network Indicators:

Proxy cache serving responses with Set-Cookie headers to multiple clients
Missing Vary: Cookie headers in responses

SIEM Query:

source="proxy_logs" AND ("Set-Cookie" AND cache_hit) OR source="app_logs" AND (session_collision OR unexpected_session)

📊 Metadata

CVE ID: CVE-2023-30861

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-539

Published: May 2, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-30861, you might also want to check these: