CVE-2022-51020 in flower
Summary
by MITRE • 10/13/2026
Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Flower versions prior to 2.2.0 represents a critical cross-site request forgery (CSRF) flaw rooted in the misconfiguration of session management and anti-CSRF token enforcement within the Tornado web framework integration. Specifically, the application has xsrf_cookies disabled, which effectively disables the automatic generation and validation of CSRF tokens for incoming requests. This configuration choice removes a primary defense mechanism against state-changing actions initiated by malicious third-party sites. Furthermore, the OAuth session cookie utilized during authentication lacks the SameSite attribute, leaving it susceptible to being sent automatically with cross-origin HTTP requests. The combination of these two factors creates an environment where authenticated users can be tricked into performing unintended administrative operations without their knowledge or consent.
The operational impact of this vulnerability is severe due to the sensitive nature of the endpoints targeted by attackers. Malicious actors can craft phishing pages that, when visited by a logged-in Flower administrator, automatically POST requests to critical Celery management APIs such as /api/worker/shutdown, /api/worker/pool/restart, and /api/task/revoke. The execution of these actions allows an attacker to disrupt the availability of distributed computing resources by shutting down worker nodes, which halts task processing entirely. Additionally, restarting pools can cause temporary service interruptions while workers reinitialize, and revoking tasks can lead to data loss or incomplete business logic execution if critical background jobs are terminated prematurely. This constitutes a significant denial-of-service condition as well as a potential integrity compromise depending on the specific tasks being revoked.
From a classification perspective, this vulnerability aligns with CWE-352 Cross-Site Request Forgery (CSRF), which describes attacks that trick users into performing actions they did not intend to perform. The lack of SameSite cookie attributes also relates to CWE-1004 Sensitive Cookie Without 'SameSite' Attribute, a common misconfiguration in modern web applications that fails to restrict how cookies are sent with cross-site requests. In the context of the MITRE ATT&CK framework, this attack vector maps to T1566.002 Phishing: Spearphishing Link and potentially T1499 Endpoint Denial of Service if the shutdown actions result in sustained unavailability of compute resources. The exploitation relies on social engineering tactics where an authenticated user is lured to a malicious site, leveraging their existing valid session tokens against the application itself.
To mitigate this vulnerability, immediate action must be taken by upgrading Flower to version 2.2.0 or later, as these releases address the underlying configuration issues and enforce stricter security defaults for CSRF protection. For environments where an upgrade is not immediately feasible, administrators should manually enable xsrf_cookies in the Tornado application settings to ensure that anti-CSRF tokens are generated and validated for all state-changing requests. Additionally, configuring the OAuth session cookie with the SameSite attribute set to Strict or Lax will prevent the browser from sending these cookies during cross-origin POST requests initiated by malicious third-party sites. Implementing additional verification steps such as requiring explicit user confirmation for sensitive administrative actions can also provide a layer of defense against automated CSRF attacks. Regular security audits and adherence to OWASP guidelines for session management are recommended to maintain robust protection against similar threats in the future.