PT-2023-8517 · Pyload · Pyload
Kaydoda
+1
·
Publicado
2023-01-17
·
Atualizado
2024-01-29
·
CVE-2024-22416
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
pyLoad versions prior to 0.5.0b3.dev78
Description
The issue is related to a Cross-Site Request Forgery (CSRF) attack. Since the session cookie is not set to
SameSite: strict, this opens the library up to severe attack possibilities. Any API call can be made via a CSRF attack by an unauthenticated user. For example, an attacker can trick an administrator into visiting a malicious page, which can make a request to /api/add user/ and add a new administrator to the pyload application.Recommendations
For versions prior to 0.5.0b3.dev78, upgrade to release 0.5.0b3.dev78 or later to address the issue. As a temporary workaround, consider restricting access to the
pyload API to minimize the risk of exploitation. Avoid using the pyload API until the issue is resolved.Exploit
Correção
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Pyload