Log in Start free

Vulnerability · Published Oct 25, 2024 · Assigned by GitHub_M

CVE-2024-47821pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API

Critical 9.1

In plain English

A critical-severity OS command injection in pyload from pyload. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.7%top 47.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved in versions prior to 0.5.0b3.dev87. A file can be downloaded to such a folder by changing the download folder to a folder in `/scripts` path and using the `/flashgot` API to download the file. This vulnerability allows an attacker with access to change the settings on a pyload server to execute arbitrary code and completely compromise the system. Version 0.5.0b3.dev87 fixes this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIpyload-ng0.5.0b3.dev87GHSA-w7hq-f2pj-c53g
PyPIpyload-ngno fix listedPYSEC-2024-302

Affected products (as reported)

VendorProductVersions
pyload pyload < 0.5.0b3.dev87

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References