CVE-2024-6221
📋 TL;DR
This vulnerability in flask-cors 4.0.1 sets the Access-Control-Allow-Private-Network CORS header to true by default, allowing external websites to make requests to private network resources. This affects any application using the vulnerable version of flask-cors that exposes endpoints to the internet or untrusted networks.
💻 Affected Systems
- corydolphin/flask-cors
📦 What is this software?
Flask Cors by Corydolphin
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal network resources, data exfiltration, lateral movement within private networks, and potential ransomware deployment.
Likely Case
Unauthorized access to internal APIs, services, or data sources that should be restricted to private networks, leading to data breaches.
If Mitigated
Limited impact if proper network segmentation, firewall rules, and CORS policies are already in place.
🎯 Exploit Status
Exploitation requires a malicious website that can make cross-origin requests to the vulnerable application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.2
Vendor Advisory: https://github.com/corydolphin/flask-cors/commit/03aa3f8e2256437f7bad96422a747b98ab5e31bf
Restart Required: Yes
Instructions:
1. Update flask-cors to version 4.0.2 or later using pip: pip install --upgrade flask-cors>=4.0.2
2. Restart your Flask application
3. Verify the update with: pip show flask-cors
🔧 Temporary Workarounds
Explicitly set Access-Control-Allow-Private-Network header
allManually configure CORS to set Access-Control-Allow-Private-Network to false or restrict origins
from flask_cors import CORS
CORS(app, resources={r"/*": {"origins": "*", "allow_private_network": False}})
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to block external access to private network resources
- Use reverse proxies or WAFs to filter requests with suspicious CORS headers
🔍 How to Verify
Check if Vulnerable:
Check if flask-cors version is exactly 4.0.1: pip show flask-cors | grep VersionCheck Version:
pip show flask-cors | grep VersionVerify Fix Applied:
Verify flask-cors version is 4.0.2 or higher: pip show flask-cors | grep Version📡 Detection & Monitoring
Log Indicators:
- Unusual cross-origin requests to internal endpoints
- Requests with Access-Control-Allow-Private-Network headers
Network Indicators:
- Unexpected CORS preflight requests from external domains to internal endpoints
SIEM Query:
web_access_logs | where user_agent contains "Mozilla" and url contains "/api/" and referer not in ("trusted_domains")