Authentication Bypass Affecting flask-security-too package, versions [3.2.0,3.4.5)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-FLASKSECURITYTOO-5591155
- published 22 May 2023
- disclosed 22 May 2023
- credit Unknown
How to fix?
Upgrade Flask-Security-Too to version 3.4.5 or higher.
Overview
Affected versions of this package are vulnerable to Authentication Bypass such that it is possible for a malicious 3rd party to access the QRcode and therefore gain access to two-factor authentication codes.
Note:
The /tf-qrcode endpoint is ONLY accessible while the user is initially setting up their device. Once setup is complete, there is no vulnerability.
Workaround
Users can provide their own URL for fetching the QRcode by defining SECURITY_TWO_FACTOR_QRCODE_URL and providing their own implementation (that presumably required a POST with CSRF protection). This would require changing the two-factor setup template as well.