Code Snippet Vulnerability Check

Henkel runs an internal Flask portal for employee expense reports. Security is doing a pre-launch review of this endpoint file before it goes further than a pilot group.

import os
import pickle
import sqlite3
from flask import Flask, request

app = Flask(__name__)
app.secret_key = "henkel-int-portal-2024"

@app.route("/api/expenses/search")
def search_expenses():
    employee_name = request.args.get("name")
    conn = sqlite3.connect("expenses.db")
    query = "SELECT * FROM expenses WHERE employee_name = '" + employee_name + "'"
    cursor = conn.execute(query)
    return {"results": cursor.fetchall()}

@app.route("/api/expenses/delete", methods=["POST"])
def delete_expense():
    expense_id = request.form.get("id")
    conn = sqlite3.connect("expenses.db")
    conn.execute("DELETE FROM expenses WHERE id = ?", (expense_id,))
    conn.commit()
    return {"status": "deleted"}

@app.route("/api/expenses/receipt", methods=["POST"])
def convert_receipt():
    filename = request.form.get("filename")
    os.system(f"convert uploads/{filename} -resize 800x600 processed/{filename}.png")
    return {"status": "converted"}

@app.route("/api/expenses/import", methods=["POST"])
def import_expenses():
    data = pickle.loads(request.data)
    return {"imported": len(data)}

Write up the vulnerabilities you find in this file. For each one, explain how it could be exploited and how you would fix it.