CVE-2026-78553: Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook
RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access the RansomLook home directory could read the application's cryptographic secret.
The exposed key is security-critical because it is used to sign Flask session cookies and is also involved in the legacy API-key key derivation. An attacker who obtains the key can generate valid session cookies and impersonate an authenticated user, including an administrator. In LDAP configurations, exploitation may be particularly straightforward because the session user loader does not require the supplied username to correspond to an existing local user.
Successful exploitation requires local access sufficient to read the improperly protected file, but can result in complete compromise of RansomLook's authentication and authorization controls.
The patch creates new secret-key files atomically with permissions 0600 and also restricts permissions on existing key files during application startup.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the Flask secret-key file is created with restrictive permissions 0600 and that any existing secret-key files have their permissions restricted during application startup (the patch creates new secret-key files atomically with 0600 and restricts permissions on existing key files).
RansomLook (Flask) secret_key file permissions = 0600 - Operational
On the affected host, re-check/repair the filesystem permissions for the Flask secret_key file to ensure it is not world-readable (avoid permissions such as 0644 under a common umask of 022) so local users cannot read the cryptographic secret.
Event History
Frequently Asked Questions
Who is realistically able to exploit this issue?
An attacker needs local access sufficient to read RansomLook's secret_key file, which may be possible for other local users when the RansomLook home directory and key file are accessible. Remote access alone is not described as sufficient.
Are default deployments affected?
Deployments are affected when the secret_key file was created with permissive process-default permissions and umask settings. Under a common 022 umask, the file can be created with 0644 permissions.
What can an attacker do after obtaining the key?
They can forge valid Flask session cookies and impersonate authenticated users, including administrators, bypassing RansomLook authentication and authorization controls. The key also affects legacy API-key derivation.
Is LDAP configuration relevant to exploitation?
Yes. In LDAP configurations, exploitation may be especially straightforward because the session user loader does not require the supplied username to match an existing local user.
What should be done if the patched version cannot be deployed immediately?
Restrict the existing secret_key file so that only its owner can read it, using permissions equivalent to 0600, and ensure unauthorized local users cannot access the RansomLook home directory. The patch also applies restrictive permissions to existing key files during application startup.