GHSA-FXQ4-R6MR-9X64低危已审查

CSRF Vuln can expose user's QRcode

OSV 1.4.0 · github-reviewed · 修改于 2021-04-09 00:45

发布时间

2021-04-09 00:46

GitHub 审查时间

2021-04-09 00:45

NVD 发布时间

—

源文件

advisories/github-reviewed/2021/04/GHSA-fxq4-r6mr-9x64/GHSA-fxq4-r6mr-9x64.json

公告说明

Impact

When a user is setting up two-factor authentication using an authenticator app, a QRcode is generated and made available via a GET request to /tf-qrcode. Since GETs do not have any CSRF protection, it is possible a malicious 3rd party could access the QRcode and therefore gain access to two-factor authentication codes. Note that the /tf-qrcode endpoint is ONLY accessible while the user is initially setting up their device. Once setup is complete, there is no vulnerability.

Patches

This is fixed in the upcoming 4.0.0 release.

Workarounds

You can provide your own URL for fetching the QRcode by defining SECURITY_TWO_FACTOR_QRCODE_URL and providing your own implementation (that presumably required a POST with CSRF protection). This would require changing the two-factor setup template as well.

References

None.

For more information

If you have any questions or comments about this advisory:

Read this pull request: #423

受影响的软件包

PyPI

Flask-Security-Too

标识信息

别名 / CVE

无

CWE

CWE-352

软件生态

PyPI

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-fxq4-r6mr-9x64",
  "aliases": [],
  "details": "### Impact\nWhen a user is setting up two-factor authentication using an authenticator app, a QRcode is generated and made available via a GET request to /tf-qrcode. Since GETs do not have any CSRF protection, it is possible a malicious 3rd party could access the QRcode and therefore gain access to two-factor authentication codes. Note that the /tf-qrcode endpoint is ONLY accessible while the user is initially setting up their device. Once setup is complete, there is no vulnerability.\n\n### Patches\nThis is fixed in the upcoming 4.0.0 release.\n\n### Workarounds\nYou can provide your own URL for fetching the QRcode by defining SECURITY_TWO_FACTOR_QRCODE_URL and providing your own implementation (that presumably required a POST with CSRF protection). This would require changing the two-factor setup template as well.\n\n### References\nNone.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Read this pull request: #423",
  "summary": "CSRF Vuln can expose user's QRcode",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "3.2.0"
            },
            {
              "fixed": "3.4.5"
            }
          ]
        }
      ],
      "package": {
        "name": "Flask-Security-Too",
        "ecosystem": "PyPI"
      }
    }
  ],
  "modified": "2021-04-08T16:45:47Z",
  "severity": [],
  "published": "2021-04-08T16:46:00Z",
  "references": [
    {
      "url": "https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-fxq4-r6mr-9x64",
      "type": "WEB"
    },
    {
      "url": "https://pypi.org/project/Flask-Security-Too",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2021-04-08T16:45:47Z"
  }
}