CVE-2024-24808

Executive Summary

CVE-2024-24808 is an open redirect vulnerability in pyLoad, an open-source Download Manager written in pure Python. The flaw exists in the login redirect mechanism, where the get_redirect_url function fails to properly validate user-supplied URLs. An attacker can craft a malicious link that, when clicked by an authenticated user, redirects them to an external, attacker-controlled site. This can be leveraged for phishing attacks, credential harvesting, or bypassing URL-based access controls. The vulnerability has a CVSS score of 4.7 (Medium) and is patched in commit fe94451. No public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

pyLoad is distributed via PyPI as pyload-ng. Users should verify the integrity of their installation and ensure they are running a version that includes the patch commit fe94451 or later. The vulnerability is introduced in the source code, not through a dependency, but supply chain risks include the possibility of a compromised PyPI package if the maintainer's account is breached.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim must click a crafted link.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – Limited information disclosure possible via phishing.
• Integrity (I): Low – The redirect can lead to a site that modifies user data.
• Availability (A): None – No impact on service availability.

Threat Level: Medium. While the CVSS score is moderate, the open redirect can be a powerful tool in social engineering campaigns, especially when combined with other vulnerabilities.

Deep Dive & Mechanics

The vulnerability resides in the login flow of pyLoad. When a user successfully logs in, the application redirects them to a URL specified in the next parameter (or similar). The get_redirect_url function is responsible for validating this URL to prevent open redirects. However, the validation logic is flawed.

Vulnerable Logic: The get_redirect_url function likely checks if the URL starts with a known path (e.g., /) or contains the application's domain. However, it fails to account for URLs that use alternative representations, such as:

• //attacker.com (protocol-relative URL)
• https://attacker.com (if the domain check is case-insensitive or incomplete)
• http://evil.com@legitimate.com (using the @ character to confuse parsers)

Attack Flow:

1. An attacker crafts a URL like: https://vulnerable-pyload.com/login?next=//attacker.com/phish
2. The victim, who is logged into pyLoad, clicks the link.
3. The application processes the login (or re-authentication) and then calls get_redirect_url with //attacker.com/phish.
4. The flawed validation passes the URL as valid.
5. The victim is redirected to https://attacker.com/phish, which may host a fake login page or malware.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

def get_redirect_url(url):
    # Flawed: only checks if url starts with '/'
    if url.startswith('/'):
        return url
    # Also flawed: checks if domain is in url but allows protocol-relative
    if 'pyload' in url:
        return url
    return '/'

Patched Code (commit fe94451):

from urllib.parse import urlparse

def get_redirect_url(url):
    parsed = urlparse(url)
    # Reject if scheme is not empty and not http/https
    if parsed.scheme and parsed.scheme not in ('http', 'https'):
        return '/'
    # Reject if netloc is present and not the expected domain
    if parsed.netloc and parsed.netloc != 'pyload.net':
        return '/'
    # Reject protocol-relative URLs
    if url.startswith('//'):
        return '/'
    return url

The patch introduces proper URL parsing using urlparse and validates the scheme and network location. It also explicitly blocks protocol-relative URLs.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install a vulnerable version of pyLoad (e.g., from a commit before fe94451).
2. Set up a simple HTTP server to act as the attacker's phishing site.
3. Use a browser or curl to test the redirect.

Exploitation Steps:

1. Identify a pyLoad instance (e.g., via Shodan dork: http.title:"pyLoad").
2. Craft a malicious URL: http://target-pyload.com/login?next=//attacker.com/evil
3. Send the link to a victim via email or social engineering.
4. When the victim clicks and logs in (or is already logged in), they are redirected to attacker.com/evil.

Example curl command:

curl -v "http://target-pyload.com/login?next=//attacker.com/evil"

Blue Team (Defensive)

Detection:

• Monitor logs for unusual next parameters containing external domains or protocol-relative URLs.
• Use a WAF rule to block redirects to external domains unless explicitly allowed.

Mitigation:

• Immediately update pyLoad to the patched version (commit fe94451 or later).
• If patching is not possible, implement a reverse proxy that validates redirect URLs.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to pyLoad login endpoint with next parameter containing external domains (e.g., next=//evil.com).
  • Outbound connections from pyLoad server to unknown external domains immediately after a login event.

• File IOCs:

  • Modified pyload/core/web/app.py or similar files if the patch is not applied.

• Log IOCs:

  • Log entries showing redirects to external URLs in the application logs.

Detection Engineering

YARA Rule

rule CVE_2024_24808_Open_Redirect {
    meta:
        description = "Detects vulnerable pyLoad code with open redirect in get_redirect_url"
        author = "Valters IT"
        date = "2024-02-20"
        reference = "CVE-2024-24808"
    strings:
        $vuln_func = "def get_redirect_url"
        $vuln_check = "url.startswith('/')"
        $vuln_domain = "'pyload' in url"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-24808 pyLoad Open Redirect
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-24808 via suspicious redirect parameters
author: Valters IT
date: 2024/02/20
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'next=//'
    condition: selection
falsepositives:
    - Legitimate use of protocol-relative URLs (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24808 pyLoad Open Redirect Attempt"; flow:to_server; content:"GET"; http_method; content:"/login"; http_uri; content:"next=//"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Update pyLoad to the latest version that includes commit fe94451. If using PyPI, run pip install --upgrade pyload-ng.
2. Workaround: If patching is not possible, implement a reverse proxy (e.g., Nginx) that validates the next parameter and blocks redirects to external domains.
3. Monitoring: Enable logging of all redirect actions and monitor for suspicious next values.
4. User Awareness: Educate users not to click on suspicious links, especially those containing next= parameters.

Valters IT Senior DevSecOps & Cyber Threat Intelligence Expert