CVE-2024-6839: Flask-CORS Information Disclosure Vulnerability

CVE-2024-6839 Overview

CVE-2024-6839 affects corydolphin/flask-cors version 4.0.1, a widely used Python library that adds Cross-Origin Resource Sharing (CORS) support to Flask applications. The vulnerability stems from improper regex path matching, where the plugin prioritizes longer regex patterns over more specific ones. This ordering flaw causes less restrictive CORS policies to override stricter rules on sensitive endpoints. Attackers can exploit this mismatch to gain unauthorized cross-origin access to protected resources. The issue is tracked under CWE-41: Improper Resolution of Path Equivalence.

Critical Impact
Unauthorized cross-origin requests can access sensitive endpoints when broader regex patterns override more specific, restrictive CORS rules.

Affected Products

flask-cors version 4.0.1
Flask applications relying on regex-based CORS route configuration
Debian LTS distributions packaging the affected python-flask-cors release

Discovery Timeline

2025-03-20 - CVE-2024-6839 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6839

Vulnerability Analysis

Flask-CORS allows developers to configure per-route CORS policies using regex patterns keyed to URL paths. When multiple patterns match a single request path, the library must decide which policy applies. Version 4.0.1 selects the pattern with the longest string length instead of the most specific match.

This logic breaks the principle of least privilege for CORS policy evaluation. A general pattern that happens to be longer than a targeted, restrictive pattern will win the match. Sensitive endpoints protected by specific rules can therefore inherit a permissive policy applied elsewhere in the application.

The result is that browsers will honor Access-Control-Allow-Origin headers reflecting the wrong policy. Cross-origin JavaScript can then read responses from endpoints that developers intended to keep restricted to trusted origins.

Root Cause

The root cause is the pattern selection algorithm inside the Flask-CORS route matcher. Instead of ranking regex specificity or matching insertion order, the code sorts candidate patterns by raw string length. Length is not a valid proxy for specificity in regular expressions.

Attack Vector

An attacker hosts a malicious page on an origin not intended to be trusted. When a victim with an authenticated session visits that page, cross-origin requests are issued to the vulnerable Flask application. Because the wrong CORS policy applies, the browser exposes response data back to attacker-controlled JavaScript. No authentication or user interaction beyond visiting the attacker's page is required to trigger the flawed matching. Refer to the Huntr Bounty Report for the proof-of-concept walkthrough.

Detection Methods for CVE-2024-6839

Indicators of Compromise

Unexpected Access-Control-Allow-Origin values reflecting untrusted origins on sensitive endpoints
Repeated preflight OPTIONS requests from unfamiliar origins targeting authenticated API routes
Successful cross-origin GET or POST requests carrying session cookies from external referrers

Detection Strategies

Inventory Python dependencies and flag any project using flask-cors==4.0.1
Audit application CORS configurations for overlapping regex patterns with differing origins policies
Compare emitted CORS response headers against intended per-route policy in staging and production

Monitoring Recommendations

Log all CORS-related response headers at the reverse proxy or WSGI middleware layer
Alert on cross-origin requests to authenticated endpoints from origins outside an approved allowlist
Track dependency drift using software composition analysis integrated with CI/CD pipelines

How to Mitigate CVE-2024-6839

Immediate Actions Required

Upgrade flask-cors to the latest patched release available on PyPI
Review every regex used in CORS(app, resources=...) and remove patterns that overlap sensitive routes
Apply Debian security updates as published in the Debian LTS Security Announcement

Patch Information

Upstream maintainers of corydolphin/flask-cors have addressed the regex prioritization logic in versions after 4.0.1. Debian LTS has issued a corresponding update for the python-flask-cors package. Consult the Huntr Bounty Report and the Debian advisory for exact fixed versions applicable to your distribution.

Workarounds

Replace regex-based route matching with explicit string paths in the resources dictionary
Enforce a strict origin allowlist at a reverse proxy such as nginx or a Web Application Firewall
Disable credentialed CORS on sensitive endpoints until the library upgrade is verified in production

bash

# Configuration example
pip install --upgrade flask-cors
pip show flask-cors | grep Version