CVE-2024-22416

Cross-Site Request Forgery (CSRF) vulnerability in pyLoad (before release 0.5.0b3.dev78)

• CVSS 8.8
• CWE-352: Cross-Site Request Forgery (CSRF)
• Configuration Issues
• Remote

pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.

CVE

CVE-2024-22416

CWE

CWE-352: Cross-Site Request Forgery (CSRF)

CVSS base score

8.8

Published

2024-01-17

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Interface

Code defect classification

Missing Interface

Category

Configuration Issues

Subcategory

Cross-Site Request Forgery (CSRF)

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update to pyLoad version 0.5.0b3.dev78 or higher

from flask import Flask, request

app = Flask(__name__)

@app.route('/api/some_endpoint', methods=['GET'])
def some_endpoint():
    return "API call successful", 200

if __name__ == '__main__':
    app.run()

from flask import Flask, request, make_response

app = Flask(__name__)

@app.route('/api/some_endpoint', methods=['GET'])
def some_endpoint():
    csrf_token = request.headers.get('X-CSRF-Token')
    if not csrf_token or csrf_token != 'expected_csrf_token':
        return "CSRF token is missing or invalid", 403

    return "API call successful", 200

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve202422416,
  title        = {{Cross-Site Request Forgery (CSRF) vulnerability in pyLoad (before release 0.5.0b3.dev78)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-22416},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-22416/}}
}