Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
References 6
https://github.com/mher/flower
disclosure@vulncheck.com
https://github.com/mher/flower/blob/v2.1.0/flower/api/control.py#L25-L27
disclosure@vulncheck.com
https://github.com/mher/flower/commit/3b2115af7f9c42bd2da2fbcbd919f77013e9ec51
disclosure@vulncheck.com
https://github.com/mher/flower/commit/a14408b16cc3d2877d36659005ce0d72b6162629
disclosure@vulncheck.com
https://github.com/mher/flower/issues/1217
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/flower-before-2.2.0-csrf-via-worker-and-ta…
disclosure@vulncheck.com