Python: Flask & Django Constant Secret Key initialization

[am0o0]

Query PR

github/codeql#13561

Language

Python

CVE(s) ID list

• CVE-2023-27524
• CVE-2020-17526
• CVE-2021-41192

CWE

CWE-287: Improper Authentication

Report

1. Flask and Django require a Securely signed key for singing the session cookies. most of the time developers rely on load hardcoded secret keys from a config file or python code. this proves that the way of hardcoded secret can make problems when you forgot to change the constant secret keys.
2. I used taint tracking from constants or nodes that provide default constant to an initialization of Flask and Django SECRET_KEY Value/Field.
3. I did some sanitizations to reduce the FP rate as much as possible.

Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).

• Yes
• No

Blog post link

definitely I will publish a blog post soon!

[ghsecuritylab]

Your submission is now in status Query review.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ghsecuritylab]

Your submission is now in status Final decision.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[xcorail]

Created Hackerone report 2123678 for bounty 508102 : [766] Python: Flask & Django Constant Secret Key initialization

[ghsecuritylab]

Your submission is now in status Closed.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed