CVE-2024-6844

Advisory

Affected versions of the flask-cors package are vulnerable to Improper Input Validation due to inconsistent URL path handling when processing the '+' character. The package incorrectly uses the unquote_plus function on request.path, which converts '+' characters to spaces, resulting in path normalization errors that prevent proper CORS policy matching for endpoints containing '+' symbols. An attacker can exploit this vulnerability by accessing endpoints with '+' characters in their paths to bypass intended CORS restrictions or cause legitimate cross-origin requests to be incorrectly blocked, potentially exposing sensitive data to unauthorized origins or disrupting application functionality.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-8vgw-p6qm-5gr7
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6844