ArchLinux: 202105-2: python-flask-security-too: cross-site request forgery
Summary
In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
Resolution
Upgrade to 4.0.1-1.
# pacman -Syu "python-flask-security-too>=4.0.1-1"
The problem has been fixed upstream in version 4.0.1.
References
https://bugs.archlinux.org/task/70041 https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv https://github.com/Flask-Middleware/flask-security/issues/421 https://github.com/Flask-Middleware/flask-security/pull/422 https://github.com/Flask-Middleware/flask-security/commit/c05afe837e83f20f59c0fb409ce1240341d1ec41 https://security.archlinux.org/CVE-2021-21241
Workaround
If you aren't using authentication tokens, you can setSECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the tokenunusable.