CVE-2024-21645

Log injection vulnerability in pyLoad 0.5.0b3.dev77

• CVSS 5.3
• CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
• Design Defects
• Remote

pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. Forged or otherwise, corrupted log files can be used to cover an attacker’s tracks or even to implicate another party in the commission of a malicious act. This vulnerability has been patched in version 0.5.0b3.dev77.

CVE

CVE-2024-21645

CWE

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSS base score

5.3

Published

2024-01-08

OWASP

A09 Security Logging and Monitoring Failures

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Design Defects

Subcategory

Inadequate Error Handling

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update to version 0.5.0b3.dev77 or later

import logging

logger = logging.getLogger("pyload")
logger.setLevel(logging.INFO)
handler = logging.FileHandler("pyload.log")
formatter = logging.Formatter('%(asctime)s - %(levelname)s - %(message)s')
handler.setFormatter(formatter)
logger.addHandler(handler)

def log_message(message):
    logger.info(message)

log_message("User  logged in successfully.")
log_message("Log entry: \n[ATTACKER] This is a forged log entry.")

import logging

logger = logging.getLogger("pyload")
logger.setLevel(logging.INFO)
handler = logging.FileHandler("pyload.log")
formatter = logging.Formatter('%(asctime)s - %(levelname)s - %(message)s')
handler.setFormatter(formatter)
logger.addHandler(handler)

def log_message(message):
    sanitized_message = sanitize_input(message)
    logger.info(sanitized_message)

def sanitize_input(user_input):
    return user_input.replace('\n', ' ').replace('\r', ' ').replace('\t', ' ')

log_message("User  logged in successfully.")
log_message("Log entry: \n[ATTACKER] This is a forged log entry.")

@misc{vaitp:cve202421645,
  title        = {{Log injection vulnerability in pyLoad 0.5.0b3.dev77}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-21645},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-21645/}}
}