CVE-2024-6866

Advisory

Affected versions of the flask‑cors package are vulnerable to Improper Handling of Case Sensitivity due to case‑insensitive request path matching caused by using the try_match function, originally intended for hostnames. The cors_after_request logic applies unquote_plus to request.path and then uses try_match_pattern with caseSensitive=True only in patched versions, whereas the vulnerable behaviour uses try_match (case‑insensitive), resulting in mismatches between the intended case‑sensitive URL paths and the CORS matching. An attacker can exploit this by crafting requests with differently cased path segments that bypass restrictions on sensitive endpoints, enabling unauthorized cross‑origin access and potential data exposure.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-43qf-4rqw-9q2g
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6866