PT-2024-18995 · Pyload · Pyload

Pinkdraconian · Published 2024-01-08 · Updated 2024-01-11 · CVE-2024-21645

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions pyload versions prior to 0.5.0b3.dev77

Description A log injection issue allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload. This can be achieved by supplying a username containing a newline when attempting to sign in with faulty credentials, as the newline is not properly escaped and serves as the delimiter between log entries. Forged or corrupted log files can be used to cover an attacker's tracks or implicate another party in a malicious act.

Recommendations For versions prior to 0.5.0b3.dev77, update to version 0.5.0b3.dev77 to resolve the issue. As a temporary workaround, consider restricting access to the login functionality to minimize the risk of exploitation. Avoid using the username parameter in the login endpoint until the issue is resolved.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2024-21645

GHSA-GHMW-RWH8-6QMR

Affected Products

Pyload

References · 8

• 🔥 https://github.com/pyload/pyload/security/advisories/GHSA-ghmw-rwh8-6qmr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21645.json · Exploit
• https://github.com/pyload/pyload/commit/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d · Patch
• https://osv.dev/vulnerability/GHSA-ghmw-rwh8-6qmr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21645 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21645 · Security Note
• https://github.com/pyload/pyload · Note
• https://t.me/cvenotify/66617 · Telegram Post