CyberRota Analysis
AI-GeneratedFlowintel versions 3.3.0 and above are vulnerable due to improper validation of login email addresses, allowing attackers to inject malicious input that can manipulate security logs. This could lead to the creation of misleading log entries or additional log lines, potentially obscuring malicious activities. Organizations using affected versions should prioritize patching to mitigate the risk of log injection attacks and maintain the integrity of their security monitoring.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process and be written to security-relevant logs. The vulnerable code inserted the supplied email into both a warning log and the custom audit logger. Since CR/LF characters were not escaped, an unauthenticated attacker could potentially inject additional physical log lines or forge misleading log entries. The patch corrects the validation call to Email()(form, form.email), changes the standard logging call to parameterized logging, and introduces _sanitize_log_fragment() so carriage returns and line feeds are encoded instead of creating new records. Version impacted >=3.3.0