high7.5

CVE-2023-30861

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

Impact

When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on _all_ these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets [`session.permanent = True`](https://flask.palletsprojects.com/en/2.3.x/api/#flask.session.permanent). 2. The application does not access or modify the session at any point during a request. 4. [`SESSION_REFRESH_EACH_REQUEST`](https://flask.palletsprojects.com/en/2.3.x/config/#SESSION_REFRESH_EACH_REQUEST) is enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified.

Affected packages

Ecosystem	Package	Affected	Fixed in
pip	`flask`	>= 2.3.0, < 2.3.2	2.3.2

Affected products

Vendor	Product	Affected versions
Palletsprojects	Flask	before 2.2.5 from 2.3.0 before 2.3.2

Weakness classification

CWE-539

Impact

Affected packages

Affected products

Weakness classification

References