Vulnerability · Published Jan 17, 2024 · Assigned by GitHub_M
CVE-2024-22416Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
Critical 9.7
In plain English
A critical-severity cross-site request forgery in pyload from pyload. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | pyload-ng | 0.5.0b3.dev78 | GHSA-pgpj-v85q-h5fm |
| PyPI | pyload-ng | 0.5.0b3.dev78 | PYSEC-2024-17 |
Affected products (as reported)
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H