CVE-2021-33026

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code. NOTE: a third party indicates that exploitation is extremely unlikely unless the machine is already compromised; in other cases, the attacker would be unable to write their payload to the cache and generate the required collision

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/pallets-eco/flask-caching/pull/209#issuecomment-1136397937	Issue Tracking Patch Third Party Advisory
https://github.com/sh4nks/flask-caching/pull/209	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:flask-caching_project:flask-caching:*:*:*:*:*:flask:*:*

History

No history.

Information

Published : 2021-05-13 23:15

Updated : 2024-07-19 19:15

NVD link : CVE-2021-33026

Mitre link : CVE-2021-33026

CVE.ORG link : CVE-2021-33026

JSON object : View

Products Affected

flask-caching_project

flask-caching

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2021-33026", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-05-13T23:15:07.367", "references": [{"url": "https://github.com/pallets-eco/flask-caching/pull/209#issuecomment-1136397937", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/sh4nks/flask-caching/pull/209", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code. NOTE: a third party indicates that exploitation is extremely unlikely unless the machine is already compromised; in other cases, the attacker would be unable to write their payload to the cache and generate the required collision"}, {"lang": "es", "value": "** EN DISPUTA ** La extensi\u00f3n Flask-Caching hasta la versi\u00f3n 1.10.1 para Flask se basa en Pickle para la serializaci\u00f3n, lo que puede llevar a la ejecuci\u00f3n remota de c\u00f3digo o a la escalada local de privilegios. Si un atacante obtiene acceso al almacenamiento de la cach\u00e9 (por ejemplo, el sistema de archivos, Memcached, Redis, etc.), puede construir una carga \u00fatil manipulada, envenenar la cach\u00e9 y ejecutar c\u00f3digo Python. NOTA: un tercero indica que la explotaci\u00f3n es extremadamente improbable a menos que la m\u00e1quina ya est\u00e9 comprometida; en otros casos, el atacante no podr\u00eda escribir su carga \u00fatil en la cach\u00e9 y generar la colisi\u00f3n necesaria"}], "lastModified": "2024-07-19T19:15:05.890", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flask-caching_project:flask-caching:*:*:*:*:*:flask:*:*", "vulnerable": true, "matchCriteriaId": "04389DFA-32B3-4F65-BBDB-6321BA631F81", "versionEndIncluding": "1.10.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}