flask-security@1.6.1 vulnerabilities

Flask-Security is a Simple security for Flask apps.

Affected versions of this package are vulnerable to Information Exposure. An attacker could send a GET request to /login?include_auth_token that returns an authentication token without performing a CSRF check.

Upgrade Flask-Security to version 5.5.1 or higher.

Flask-Security is a Simple security for Flask apps.

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Externally-Accessible File or Directory. A GET request to /tf-qrcode returns the QR code without requiring a CSRF token. If other security measures, such as CORS, fail, an attacker could load this image on a third-party site visited by a logged-in user, allowing them to obtain the TOTP secret and generate valid 2FA codes in the future, as the secret does not change.

Upgrade Flask-Security to version 5.5.1 or higher.

Flask-Security is a Simple security for Flask apps.

Affected versions of this package are vulnerable to Open Redirect via the the /login and /register routes, using the ?next parameter.

Note:

With Werkzeug >=2.1.0 the autocorrect_location_header configuration was changed to False - which means that location headers in redirects are relative by default. Thus, this issue may impact applications that were previously not impacted, if they are using Werkzeug >=2.1.0 as the WSGI layer.

There is no fixed version for Flask-Security.

Flask-Security is a Simple security for Flask apps.

Affected versions of this package are vulnerable to Timing Attack. The time it takes to process a login request is considerably less if the user-specified doesn't exist than if the password is incorrect. This can be used as a user enumeration attack, even if the login error messages were customized to avoid this.

A fix was pushed into the master branch but not yet published.

Flask-Security is a Simple security for Flask apps.

Affected versions of this package are vulnerable to Open Redirect. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path.

This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False`.

Note: Flask-Security is not maintained anymore.

There is no fixed version for Flask-Security.