Listen to this Post
CVE-2025-47278 affects Flask, a core dependency of Faraday, a collaborative penetration testing and vulnerability management platform. In Flask 3.1.0, the framework incorrectly handled the `SECRET_KEY_FALLBACKS` configuration, which is used for cryptographic key rotation. When multiple keys are supplied for session signing, Flask is supposed to use the most recent key as the primary signing key and treat older keys as fallbacks for verification only. However, the vulnerable version reversed the internal key list construction, causing the framework to sign new sessions with the oldest fallback key instead of the current signing key. This flaw undermines the key rotation mechanism entirely. Applications that have opted into key rotation would unknowingly continue issuing sessions signed with stale keys, preventing the intended transition to fresher cryptographic material. While sessions remain cryptographically signed and data integrity is preserved, the security posture of the application degrades because compromised or outdated keys remain in active signing use far longer than intended. For Faraday, which relies on Flask for its web interface and API endpoints, this dependency vulnerability could expose session management weaknesses in deployments that utilize Flask’s built-in session handling. The issue was resolved in Flask 3.1.1, and Faraday addressed it by updating its dependency stack in version 5.21.0 under issue 8058.
DailyCVE Form:
Platform: Faraday
Version: 5.21.0
Vulnerability: Dependency CVE
Severity: Medium
date: 2025-05-13
Prediction: 2025-06-15
What Undercode Say:
Analytics:
Check installed Flask version in Faraday environment pip show flask | grep Version Verify if SECRET_KEY_FALLBACKS is configured in Faraday settings grep -r "SECRET_KEY_FALLBACKS" /path/to/faraday/config/ Inspect session signing key order in Flask application context python -c "from flask import Flask; app = Flask(<strong>name</strong>); app.config['SECRET_KEY'] = 'current'; app.config['SECRET_KEY_FALLBACKS'] = ['old1', 'old2']; print(app.secret_key)"
Exploit: (Educational Purposes!)
Educational demonstration: Forcing stale key usage in Flask 3.1.0
from flask import Flask, session
app = Flask(<strong>name</strong>)
app.config['SECRET_KEY'] = 'new_secure_key_2025'
app.config['SECRET_KEY_FALLBACKS'] = ['compromised_key_2023', 'old_key_2024']
@app.route('/login')
def login():
session['user'] = 'admin'
return "Session created with stale key due to CVE-2025-47278"
In vulnerable Flask 3.1.0, the session is signed with 'compromised_key_2023'
instead of 'new_secure_key_2025'.
Protection: from this CVE
Upgrade Flask to patched version pip install --upgrade flask>=3.1.1 Verify Faraday dependencies are updated pip install --upgrade faraday Confirm no stale keys are used in session signing python -c "import flask; print(flask.<strong>version</strong>)"
Impact:
Session tokens signed with stale fallback keys, weakening key rotation security and extending exposure to compromised cryptographic material.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
