CVE-2024-22416

CRITICAL LAB

pyload-ng < 0.5.0b3.dev78 - Unauthenticated Cross-Site Request Forgery via GET API Requests

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2024-22416. PoCs published by theorzr, mindstorm38.

AI-analyzed exploit summary This repository contains a functional Docker-based PoC for CVE-2024-22416, demonstrating a CSRF vulnerability in pyLoad that allows an attacker to add a new user via a crafted HTML page. The setup includes a pyLoad server and an attacker server hosting the malicious CSRF payload.

Description

pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.

Exploits (2)

nomisec WORKING POC
by theorzr · poc
https://github.com/theorzr/ensimag-secu3a-cve-2024-22416

This repository contains a functional Docker-based PoC for CVE-2024-22416, demonstrating a CSRF vulnerability in pyLoad that allows an attacker to add a new user via a crafted HTML page. The setup includes a pyLoad server and an attacker server hosting the malicious CSRF payload.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: pyLoad-ng 0.5.0b3.dev76
Auth required
Prerequisites: Docker and Docker Compose installed · Victim must be logged into pyLoad · Victim must visit attacker-controlled page
devstral-2 · analyzed Apr 10, 2026 Full analysis →
nomisec WORKING POC
by mindstorm38 · poc
https://github.com/mindstorm38/ensimag-secu3a-cve-2024-22416

This repository contains a functional Docker-based proof-of-concept for CVE-2024-22416, demonstrating a CSRF vulnerability in pyLoad that allows an attacker to add a new user via a crafted HTML page. The setup includes a pyLoad server and an attacker server hosting the malicious CSRF payload.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: pyLoad 0.5.0b3.dev76
Auth required
Prerequisites: Docker and Docker Compose installed · Victim must be logged into pyLoad · Victim must visit attacker-controlled page
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Scores

CVSS v3 9.6
EPSS 0.0590
EPSS Percentile 90.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (2)
pyload-ng_project/pyload-ng < 0.5.0b3.dev78
pypi/pyload-ng 0 - 0.5.0b3.dev78PyPI
Published Jan 18, 2024
Tracked Since Feb 18, 2026