CVE-2024-21644
HIGH NUCLEIpyload < 0.5.0b3.dev77 - Unauthenticated Information Exposure via Flask Config Endpoint
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-21644. PoCs published by ltranquility. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a Python script that scans for CVE-2024-21644, an unauthenticated Flask configuration leak vulnerability. It checks for the presence of 'SECRET_KEY' in the response from '/render/info.html' to determine if the target is vulnerable.
Description
pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.
Exploits (1)
This repository contains a Python script that scans for CVE-2024-21644, an unauthenticated Flask configuration leak vulnerability. It checks for the presence of 'SECRET_KEY' in the response from '/render/info.html' to determine if the target is vulnerable.
Nuclei Templates (1)
html:"pyload" || http.title:"login - pyload" || http.html:"pyload" || http.title:"pyload"
title="login - pyload" || body="pyload" || title="pyload"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N