CVE-2024-6866: corydolphin corydolphin/flask-cors Improper Handling of Case Sensitivity

Vulnerability summary

CVE-2024-6866 is a high (CVSS 7.5) Improper Handling of Case Sensitivity vulnerability in corydolphin corydolphin/flask-cors. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-03-2025
   PublishedVulnerability first disclosed.
2. 03-11-2025
   Last modifiedVulnerability information updated.

Description

corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.

• CWE-178Improper Handling of Case SensitivityThe product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.