Security vulnerabilities and automated fixes for flask issues
5 posts found
A critical command injection vulnerability was discovered in the `open_directory` method of `src/jm_view_server/app.py`, where user-controlled path input was passed directly into a shell command via `subprocess.Popen`. By switching from string-based shell execution to a list-based argument format, the fix eliminates the ability for attackers to inject malicious shell commands through crafted directory paths.
A critical command injection vulnerability was discovered in a Flask application's `/abc2xml` endpoint where user-supplied ABC music notation data could be weaponized to execute arbitrary shell commands. The `run_command` function used `subprocess.run()` with `shell=True` and string concatenation, allowing attackers to inject shell metacharacters. The fix switches to a list-based command invocation with `shell=False`, eliminating the injection vector entirely.
A high-severity Server-Side Request Forgery (SSRF) vulnerability was discovered in `webui/backend/main.py` at line 6597 of the Posterizarr project. User-controlled `request.media_type` was interpolated directly into a URL used for server-side HTTP requests to The Movie Database (TMDB) API, allowing attackers to manipulate the destination of outbound requests. The fix introduces a strict allowlist that only permits `"movie"` or `"tv"` as valid media types.
A medium-severity vulnerability was discovered and patched in an IoT Over-the-Air (OTA) firmware update server, where a Flask route accepted firmware file uploads without any authentication. This flaw allowed any attacker with network access to push arbitrary firmware binaries to connected IoT devices — a potentially devastating supply chain attack vector. The fix introduces proper authentication controls, closing the door on unauthorized firmware injection.
A critical security vulnerability was discovered and patched in a Flask REST API endpoint that accepted image file uploads without any validation, size limits, or sandboxing. An attacker could exploit this flaw to upload malicious files disguised as images, potentially leading to remote code execution or exploitation of image-parsing libraries. The fix enforces strict file type validation, magic byte inspection, and upload size limits to close this dangerous attack vector.