PT-2024-20767 · Pypi · Flask-Appbuilder

Parantheses · Published 2024-02-28 · Updated 2025-12-02 · CVE-2024-25128

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Flask-AppBuilder versions prior to 4.3.11

Description The issue allows an attacker to forge an HTTP request, deceiving the backend into using any requested OpenID service when Flask-AppBuilder is set to AUTH TYPE AUTH OID. This could grant an attacker unauthorized privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend. The vulnerability is only exploitable when the application is using the OpenID 2.0 authorization protocol.

Recommendations For Flask-AppBuilder versions prior to 4.3.11, upgrade to Flask-AppBuilder 4.3.11 to fix the vulnerability. As a temporary workaround, if an upgrade is not possible, add the provided configuration changes to your code, specifically implementing the FixedOIDView and FixedSecurityManager classes to restrict the use of unauthorized OpenID services.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-25128

GHSA-J2PW-VP55-FQQJ

Affected Products

Flask-Appbuilder

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25128.json · Exploit
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-j2pw-vp55-fqqj · Vendor Advisory
• https://github.com/dpgaspar/Flask-AppBuilder/commit/6336456d83f8f111c842b2b53d1e89627f2502c8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-25128 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2024-25128 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25128 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j2pw-vp55-fqqj · Vendor Advisory
• https://github.com/dpgaspar/Flask-AppBuilder · Note
• https://twitter.com/CVEnew/status/1762864685349560796 · Twitter Post
• https://t.me/cveNotify/138629 · Telegram Post
• https://twitter.com/bountywriteups/status/1784862968976441433 · Twitter Post