CVE-2024-22416

Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

EIP currently links 1 repository PoC and 1 lab environment to CVE-2024-22416.

Description

pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 18, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

pyload

Browse pyload / pyload
CVE List< 0.5.0b3.dev78affected

pyload-ng

Browse PyPI / pyload-ng
GitHub AdvisoryBefore 0.5.0b3.dev78 · Fixed in 0.5.0b3.dev78affected

Proofs of concept

1

Repository PoCs

GitHubtheorzr/ensimag-secu3a-cve-2024-22416Repository PoCby mindstorm380Not analyzed7 files

175.8 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

compose.yaml

theorzr/ensimag-secu3a-cve-2024-22416Created Vuln labCVE-2024-22416Compose · mixed

1 Compose manifest · 2 Dockerfiles · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that sets up a pyLoad server (version 0.5.0b3.dev76) and an attacker server serving a CSRF proof-of-concept page, intended to demonstrate CVE-2024-22416.

compose.yaml:1-15README.md:1-13

Lab assessment

Vulnerability lab

The README explicitly states the repository contains a Docker Compose configuration to test CVE-2024-22416, and the components (pyLoad server, attacker CSRF page) match a vulnerability reproduction environment.

README.md:1-8
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles2
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

pyload

vulnerable target

A pyLoad-ng 0.5.0b3.dev76 server built from python:3.10-alpine3.18, configured with debug mode and a web interface on port 8000. It exposes ports 8000 and 9666 to the host.

pyload/Dockerfile:1-5pyload/pyload.cfg:1-74compose.yaml:3-8

attacker

CSRF exploit delivery

An nginx:alpine server that serves a single csrf.html page. The page auto-submits a form to http://localhost:8000/api/add_user/ to add a user 'hacker'. It exposes port 80 mapped to host port 8001.

attacker/Dockerfile:1-2attacker/csrf.html:1-12compose.yaml:9-13
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-22416

Supported by supplied evidence

The environment is explicitly built to demonstrate CVE-2024-22416, as stated in the README. The CSRF page targets the pyLoad API to add a user, which aligns with the cross-site request forgery vulnerability described in the referenced advisory.

README.md:1-8attacker/csrf.html:4
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the environment.README.md:6-7
  • The user must log in to pyLoad at localhost:8000 with credentials pyload:pyload before triggering the CSRF.README.md:9-10

Evidence-described exercise path

  1. Run 'docker compose up' to start both services.README.md:6-7
  2. Navigate to localhost:8000 and log in with user 'pyload' and password 'pyload'.README.md:9-10
  3. Navigate to localhost:8001/csrf.html to trigger the CSRF attack, which adds a user 'hacker'.README.md:10-12
  4. Verify the attack by checking Settings > Users in pyLoad for the new 'hacker' user.README.md:12
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's own containers. The CSRF attack targets the local pyLoad service within the Docker network, and no evidence shows host escape, external connections, persistence, credential theft, or destructive actions beyond the intended vulnerability demonstration.

compose.yaml:1-15attacker/csrf.html:4README.md:1-13
Review boundaries

What the analysis did not establish

  • The packet includes a binary file 'CVE #2.pdf' that is uninspected; its content and any potential malicious payload are unknown.
  • The CSRF page targets 'localhost:8000', which resolves inside the attacker container, not the host; the actual exploit path relies on the user's browser being on the host and the port mapping, but the Docker networking is not fully detailed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

6