CVE-2024-1681: Log Injection Vulnerability in corydolphin/flask-cors

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-04-19 · updated 2026-06-17
Weakness: CWE-117

Description

corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.

Affected products

corydolphin Flask-Cors: 4.0.0

References

https://huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644
https://huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644
https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html

Get alerted when CVE-2024-1681 or the next vulnerability affects your stack