CVE-2024-21644

pyLoad 0.5.0b3.dev77 allows unauthenticated access to Flask config, exposing SECRET_KEY

• CVSS 7.5
• CWE-284 Improper Access Control
• Design Defects
• Remote

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.

CVE

CVE-2024-21644

CWE

CWE-284 Improper Access Control

CVSS base score

7.5

Published

2024-01-08

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Design Defects

Subcategory

Security Misconfigurations

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update pyLoad to version 0.5.0b3.dev77 or later

from flask import Flask, jsonify

app = Flask(__name__)

app.secret_key = 'your-secret-key'

@app.route('/config', methods=['GET'])
def get_config():
    # VULNERABLE: This code is susceptible to deserialization
    return jsonify({'SECRET_KEY': app.secret_key})

if __name__ == '__main__':
    app.run()

from flask import Flask, jsonify

app = Flask(__name__)

app.secret_key = 'your-secret-key'

@app.route('/config', methods=['GET'])
def get_config():
    # SECURE: This version prevents deserialization
    return jsonify({'message': 'Access denied'}), 403

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202421644,
  title        = {{pyLoad 0.5.0b3.dev77 allows unauthenticated access to Flask config, exposing SECRET_KEY}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-21644},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-21644/}}
}