CVE-2021-4275: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A vulnerability, which was classified as problematic, was found in katlings pyambic-pentameter. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The name of the patch is 974f21aa1b2527ef39c8afe1a5060548217deca8. It is recommended to apply a patch to fix this issue. VDB-216498 is the identifier assigned to this vulnerability.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2022-12-21T22:15Z
Repository: https://github.com/katlings/pyambic-pentameter
Language: HTML
Files changed: app.py, templates/custom.html, templates/custom_poem.html, templates/generate.html
Commit date: 2021-09-19 01:25:07 -0700
Commit message: haha actually use csrf

Diff: diff --git a/app.py b/app.py
index 3eb41eb..cb65ddf 100644
--- a/app.py
+++ b/app.py
@@ -1,7 +1,8 @@
 import logging
 from logging.handlers import RotatingFileHandler
+import os
 import random
 import re
 
 from flask import Flask, render_template, request
 from flask_wtf import FlaskForm
@@ -11,11 +12,12 @@ from .generate.generator import PoemMaker
 
 pm = PoemMaker()
 pm.setup()
 
 app = Flask(__name__)
-app.config.update(WTF_CSRF_ENABLED=False)
+SECRET_KEY = os.urandom(32)
+app.config['SECRET_KEY'] = SECRET_KEY
 
 handler = RotatingFileHandler('poems.log', maxBytes=10000, backupCount=1)
 handler.setLevel(logging.INFO)
 formatter = logging.Formatter("%(asctime)s - %(name)s - %(levelname)s - %(message)s")
 handler.setFormatter(formatter)
diff --git a/templates/custom.html b/templates/custom.html
index a2dffca..9392c1e 100644
--- a/templates/custom.html
+++ b/templates/custom.html
@@ -11,10 +11,11 @@
 <body>
   <div class="container">
     <div class="row my-5 text-center">
       <div class="col">
         <form action="" method="POST">
+          {{ form.csrf_token }}
           <div class="form-group my-3">
             <label for="source_text" class="mb-3">Copy-paste your text! The longer it is, the better and more varied results will be. It will be sanitized with most punctuation and all capitalization and whitespace stripped.</label>
             {{ form.source_text }}
           </div>
           <div class="form-group my-3">
diff --git a/templates/custom_poem.html b/templates/custom_poem.html
index ab79e31..1ccd93b 100644
--- a/templates/custom_poem.html
+++ b/templates/custom_poem.html
@@ -16,10 +16,11 @@
       </div>
     </div>
     <div class="row my-5 text-center">
       <div class="col">
         <form action="" method="POST">
+          {{ form.csrf_token }}
           {{ form.source_text }}
           <div class="form-group my-3">
             I want a {{ form.poem_format }}
           </div>
           <div class="form-group my-3">
diff --git a/templates/generate.html b/templates/generate.html
index a175e7c..eaf3198 100644
--- a/templates/generate.html
+++ b/templates/generate.html
@@ -18,10 +18,11 @@
 
       <div class="col-md pt-5 text-center">
         <div class="row my-3">
           <div class="col">
             <form action="" method="POST">
+              {{ form.csrf_token }}
               <h5>
               I want a {{ form.style }} in the style of {{ form.source }}
               <input type='submit' value='go'>
               </h5>
             </form>

Vulnerable code: app.config.update(WTF_CSRF_ENABLED=False)
Fixed code: import os
SECRET_KEY = os.urandom(32)
app.config['SECRET_KEY'] = SECRET_KEY
          {{ form.csrf_token }}
          {{ form.csrf_token }}
              {{ form.csrf_token }}