(Mirrored from https://github.com/mongodb/mongo/pull/1606)

We should consider updating flask-cors to 4.0.2 or newer.

Description

A vulnerability in mongodb was used flask version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions. This configuration exposes private network resources to unauthorized external access without requiring any user configuration.

Potential Risks

• Exposure of sensitive private network resources.
• Unauthorized access leading to data breaches, leakage of sensitive information, or network intrusions.

Severity

• CVSS Score: 8.7/10 (High)
• Weakness: CWE-284 (Improper Access Control)

Recommended Fix

• Upgrade flask-cors to version 4.0.2 or later, which resolves this issue by disabling this header by default.

References

• CVE: CVE-2024-6221