flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete users, posts, comments etc.). The problem is in the routes/adminPanelUsers file.
The problem lies in the routes/adminPanelUsers file, which does not properly verify the permissions of the requesting user before performing a role change (CWE-425 — Direct Request / Forced Browsing). The access control mechanism is based on data provided by the user, which can be manipulated (CWE-807 — Reliance on Untrusted Inputs in a Security Decision). The attacker sends a specially crafted request to the vulnerable endpoint, resulting in granting them the 'admin' role without any server-side verification.
Attacker gains full administrator privileges, enabling them to delete users, posts and comments, and perform any other operations reserved for the admin role. In practice, this means complete loss of control over the application by its legitimate administrators.
Apply patches available from the vendor according to references (advisory GHSA-6q83-vfmq-wf72 on GitHub). Until the update is applied, it is recommended to restrict access to the application only to trusted users or disable new account registration functionality.
Dogukanurker FlaskBlog version 2.8.0 and earlier
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDogukanurker Flaskblog
APPDogukanurker≤ 2.8.0
Related vulnerabilities
Nieprawidłowa kontrola dostępu w FlaskBlog — ujawnienie nazw użytkowników
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation...
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, the code checks if the userRole is "admin" onl...
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when creating a post, there's no validation of...
flaskBlog is a blog app built with Flask. In versions 2.8.1 and prior, improper sanitization of postContent wh...