CVE-2024-39205
CRITICALpyload-ng v0.5.0b3.dev85 - Remote Code Execution via Crafted HTTP Request
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2024-39205.
PoCs published by Marven11, btar1gan, Marven11, Spencer McIntyre, jheysel-r7, including Metasploit module exploits/linux/http/pyload_js2py_cve_2024_39205.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-39205, which leverages a js2py sandbox escape (CVE-2024-28397) in pyload-ng's `/flash/addcrypted2` API endpoint to achieve remote code execution. The exploit bypasses localhost restrictions via HTTP headers and executes arbitrary shell commands on vulnerable systems.
Description
An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request.
Exploits (3)
This repository contains a functional exploit for CVE-2024-39205, which leverages a js2py sandbox escape (CVE-2024-28397) in pyload-ng's `/flash/addcrypted2` API endpoint to achieve remote code execution. The exploit bypasses localhost restrictions via HTTP headers and executes arbitrary shell commands on vulnerable systems.
This exploit leverages a JavaScript-based reverse shell payload, likely targeting a Node.js or similar environment vulnerable to CVE-2024-39205. It uses prototype manipulation and subprocess execution to achieve remote code execution (RCE).
This Metasploit module exploits CVE-2024-39205 in Pyload by leveraging a js2py sandbox escape (CVE-2024-28397) to achieve unauthenticated remote code execution via the /flash/addcrypted2 API endpoint. It bypasses localhost restrictions using the HOST header and executes arbitrary commands through a crafted JavaScript payload.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H