werkzeug@2.0.0 vulnerabilities

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in formparser.MultiPartParser(). An attacker can cause the parser to consume more memory than the upload size, in excess of max_form_memory_size, by sending malicious data in a non-file field of a multipart/form-data request.

Upgrade werkzeug to version 3.0.6 or higher.

Werkzeug is a WSGI web application library.

Affected versions of this package are vulnerable to Directory Traversal due to a bypass for os.path.isabs(), which allows the improper handling of UNC paths beginning with /, in the safe_join() function. This allows an attacker to read some files on the affected server, if they are stored in an affected path.

Note: This is only exploitable on Windows systems using Python versions prior to 3.11.

Upgrade Werkzeug to version 3.0.6 or higher.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient hostname checks and the use of relative paths to resolve requests. When the debugger is enabled, an attacker can convince a user to enter their own PIN to interact with a domain and subdomain they control, and thereby cause malicious code to be executed.

The demonstrated attack vector requires a number of conditions that render this attack very difficult to achieve, especially if the victim application is running in the recommended configuration of not having the debugger enabled in production.

Upgrade werkzeug to version 3.0.3 or higher.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in multipart data parsing. An attacker can cause a denial of service and block worker processes from handling legitimate requests by sending crafted multipart data to an endpoint that will parse it, eventually exhausting or killing all available workers.

Exploiting this vulnerability is possible if the uploaded file starts with CR or LF and is followed by megabytes of data without these characters.

Upgrade werkzeug to version 2.3.8, 3.0.1 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) when parsing multipart form data. An attacker can trigger the opening of multipart files containing a large number of file parts, which are processed using request.data, request.form, request.files, or request.get_data(parse_form_data=False), consuming CPU, memory, or file handles resources. The amount of CPU time required can block worker processes from handling other requests. The amount of RAM required can trigger an out-of-memory and crash the process.

Upgrade werkzeug to version 2.2.3 or higher.

Affected versions of this package are vulnerable to Access Restriction Bypass that allows a malicious application on an adjacent subdomain to present "nameless" cookies that look like =value instead of key=value and have them accepted by the affected browser. For example, a cookie like =__Host-test=bad would be parsed as __Host-test=bad and the key treated as valid while the value is ignored.

Upgrade werkzeug to version 2.2.3 or higher.