CVE-2024-21644
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4Description
pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.
Analysis
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint. Attackers can extract this key to forge session cookies, impersonate the administrator, and execute arbitrary code through pyLoad's plugin system.
Technical Context
A specific URL path in pyLoad's web interface returns the full Flask application configuration without requiring authentication. The exposed data includes the SECRET_KEY used for signing session cookies. With this key, an attacker can forge a valid session cookie for any user including the administrator. pyLoad's admin interface allows plugin installation and script execution.
Affected Products
['pyLoad < 0.5.0b3.dev77']
Remediation
Update to pyLoad 0.5.0b3.dev77 or later. Regenerate the SECRET_KEY after patching. Never expose pyLoad's web interface to the internet without additional authentication layers. Review installed plugins for unauthorized additions.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today