CVE-2024-21644

HIGHNuclei

pyLoad unauthenticated flask configuration leakage

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-21644 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 9, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

pyload

Browse pyload / pyload
CVE List< 0.5.0b3.dev77affected

pyload-ng

Browse PyPI / pyload-ng
GitHub AdvisoryBefore 0.5.0b3.dev77 · Fixed in 0.5.0b3.dev77affected

Proofs of concept

1

Repository PoCs

GitHubltranquility/CVE-2024-21644-PocRepository PoCby ltranquility1Not analyzed3 files

2.1 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHpyLoad Flask Config - Access ControlCVSS 7.5

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.

Impact

Unauthenticated attackers can access the Flask SECRET_KEY and other sensitive configuration variables, potentially enabling session hijacking or other attacks.

Remediation

Update pyLoad to version 0.5.0b3.dev77 or later.

WeaknessesCWE-284
AuthorsWest-wise
Template tagscvecve2024pythonpippyloadaccess-controlvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*
Shodan: html:"pyload"
Shodan: http.title:"login - pyload"
Shodan: http.html:"pyload"
Shodan: http.title:"pyload"
FOFA: title="login - pyload"
FOFA: body="pyload"
FOFA: title="pyload"
Google: intitle:"login - pyload"
Google: intitle:"pyload"
https://github.com/advisories/GHSA-mqpq-2p68-46fv https://github.com/fkie-cad/nvd-json-data-feeds https://nvd.nist.gov/vuln/detail/CVE-2024-21644 https://github.com/ltranquility/CVE-2024-21644-Poc https://github.com/nomi-sec/PoC-in-GitHub

Source: ProjectDiscovery

References

4