CVE-2024-21644: Insufficient Information (NVD-CWE-noinfo)
value: pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2024-01-08T14:15Z
Repository: https://github.com/pyload/pyload
Language: HTML
Files changed: src/pyload/webui/app/blueprints/app_blueprint.py, src/pyload/webui/app/templates/info.html, src/pyload/webui/app/themes/modern/templates/info.html, src/pyload/webui/app/themes/pyplex/templates/info.html
Commit date: 2024-01-06 02:31:42 +0200
Commit message: fix GHSA-mqpq-2p68-46fv security advisory

Diff: diff --git a/src/pyload/webui/app/blueprints/app_blueprint.py b/src/pyload/webui/app/blueprints/app_blueprint.py
index 7e0613a142..4d5a4ffc29 100644
--- a/src/pyload/webui/app/blueprints/app_blueprint.py
+++ b/src/pyload/webui/app/blueprints/app_blueprint.py
@@ -450,11 +450,11 @@ def info():
     context = {
         "python": sys.version,
         "os": " ".join((os.name, sys.platform) + extra),
         "version": api.get_server_version(),
         "folder": PKGDIR,
-        "config": api.get_userdir(),
+        "config_folder": api.get_userdir(),
         "download": conf["general"]["storage_folder"]["value"],
         "freespace": format.size(api.free_space()),
         "webif": conf["webui"]["port"]["value"],
         "language": conf["general"]["language"]["value"],
     }
diff --git a/src/pyload/webui/app/templates/info.html b/src/pyload/webui/app/templates/info.html
index e384dd9a60..d15c35e2c4 100644
--- a/src/pyload/webui/app/templates/info.html
+++ b/src/pyload/webui/app/templates/info.html
@@ -2,15 +2,15 @@
 
 {% block head %}
 <script type="text/javascript" src="{{theme_template('js/info.js')}}"></script>
 {% endblock %}
 
-{% block title %}{{ _("Information") }} - {{ super() }} {% endblock %}
-{% block subtitle %}{{ _("Information") }}{% endblock %}
+{% block title %}{{_("Information")}} - {{super()}} {% endblock %}
+{% block subtitle %}{{_("Information")}}{% endblock %}
 
 {% block content %}
-<h3>{{ _("Support") }}</h3>
+<h3>{{_("Support")}}</h3>
 <ul>
     <li style="font-weight:bold;"><a href="https://pyload.net" target="_blank">Official Website</a></li>
     <li style="font-weight:bold;">
         <a href="https://github.com/pyload/pyload" target="_blank">Development</a>
         &nbsp;&nbsp;|&nbsp;&nbsp;
@@ -25,53 +25,53 @@
         &nbsp;&nbsp;|&nbsp;&nbsp;
         <a href="https://gitter.im/pyload" target="_blank">Gitter</a>
     </li>
 </ul>
 
-<h3>{{ _("System") }}</h3>
+<h3>{{_("System")}}</h3>
 <table class="system">
     <tr>
-        <td>{{ _("Python version:") }}</td>
-        <td>{{ python }}</td>
+        <td>{{_("Python version:")}}</td>
+        <td>{{python}}</td>
     </tr>
     <tr>
-        <td>{{ _("OS platform:") }}</td>
-        <td>{{ os }}</td>
+        <td>{{_("OS platform:")}}</td>
+        <td>{{os}}</td>
     </tr>
 </table>
 
-<h3>{{ _("Storage") }}</h3>
+<h3>{{_("Storage")}}</h3>
 <table class="system">
     <tr>
-        <td>{{ _("Download folder:") }}</td>
-        <td>{{ download }}</td>
+        <td>{{_("Download folder:")}}</td>
+        <td>{{download}}</td>
     </tr>
     <tr>
-        <td>{{ _("Available space:") }}</td>
-        <td>{{ freespace }}</td>
+        <td>{{_("Available space:")}}</td>
+        <td>{{freespace}}</td>
     </tr>
 </table>
 
-<h3>{{ _("pyLoad") }}</h3>
+<h3>{{_("pyLoad")}}</h3>
 <table class="system">
     <tr>
-        <td>{{ _("Version:") }}</td>
-        <td>{{ version }}</td>
+        <td>{{_("Version:")}}</td>
+        <td>{{version}}</td>
     </tr>
     <tr>
-        <td>{{ _("Installation folder:") }}</td>
-        <td>{{ folder }}</td>
+        <td>{{_("Installation folder:")}}</td>
+        <td>{{folder}}</td>
     </tr>
     <tr>
-        <td>{{ _("Config folder:") }}</td>
-        <td>{{ config }}</td>
+        <td>{{_("Config folder:")}}</td>
+        <td>{{config_folder}}</td>
     </tr>
     <tr>
-        <td>{{ _("Language:") }}</td>
-        <td>{{ language }}</td>
+        <td>{{_("Language:")}}</td>
+        <td>{{language}}</td>
     </tr>
     <tr>
-        <td>{{ _("WebUI port:") }}</td>
-        <td>{{ webif }}</td>
+        <td>{{_("WebUI port:")}}</td>
+        <td>{{webif}}</td>
     </tr>
 </table>
 {% endblock %}
diff --git a/src/pyload/webui/app/themes/modern/templates/info.html b/src/pyload/webui/app/themes/modern/templates/info.html
index d1709e807c..1040a01f6f 100644
--- a/src/pyload/webui/app/themes/modern/templates/info.html
+++ b/src/pyload/webui/app/themes/modern/templates/info.html
@@ -55,11 +55,11 @@
   <dt class="col-xs-12 col-sm-3"><b>{{_('Version:')}}</b></dt>
   <dd class="col-xs-12 col-sm-9">{{version}}</dd>
   <dt class="col-xs-12 col-sm-3"><b>{{_('Installation Folder:')}}</b></dt>
   <dd class="col-xs-12 col-sm-9">{{folder}}</dd>
   <dt class="col-xs-12 col-sm-3"><b>{{_('Config Folder:')}}</b></dt>
-  <dd class="col-xs-12 col-sm-9">{{config}}</dd>
+  <dd class="col-xs-12 col-sm-9">{{config_folder}}</dd>
   <dt class="col-xs-12 col-sm-3"><b>{{_('Language:')}}</b></dt>
   <dd class="col-xs-12 col-sm-9">{{language}}</dd>
 </dl>
 
 <h3>{{ _("WebUI") }}</h3>
diff --git a/src/pyload/webui/app/themes/pyplex/templates/info.html b/src/pyload/webui/app/themes/pyplex/templates/info.html
index efd14547fe..e67ded533e 100644
--- a/src/pyload/webui/app/themes/pyplex/templates/info.html
+++ b/src/pyload/webui/app/themes/pyplex/templates/info.html
@@ -55,11 +55,11 @@
   <dt class="col-xs-12 col-sm-3"><b>{{_('Version:')}}</b></dt>
   <dd class="col-xs-12 col-sm-9">{{version}}</dd>
   <dt class="col-xs-12 col-sm-3"><b>{{_('Installation Folder:')}}</b></dt>
   <dd class="col-xs-12 col-sm-9">{{folder}}</dd>
   <dt class="col-xs-12 col-sm-3"><b>{{_('Config Folder:')}}</b></dt>
-  <dd class="col-xs-12 col-sm-9">{{config}}</dd>
+  <dd class="col-xs-12 col-sm-9">{{config_folder}}</dd>
   <dt class="col-xs-12 col-sm-3"><b>{{_('Language:')}}</b></dt>
   <dd class="col-xs-12 col-sm-9">{{language}}</dd>
 </dl>
 
 <h3>{{ _("WebUI") }}</h3>

Vulnerable code:         "config": api.get_userdir(),
{% block title %}{{ _("Information") }} - {{ super() }} {% endblock %}
{% block subtitle %}{{ _("Information") }}{% endblock %}
<h3>{{ _("Support") }}</h3>
<h3>{{ _("System") }}</h3>
        <td>{{ _("Python version:") }}</td>
        <td>{{ python }}</td>
        <td>{{ _("OS platform:") }}</td>
        <td>{{ os }}</td>
<h3>{{ _("Storage") }}</h3>
        <td>{{ _("Download folder:") }}</td>
        <td>{{ download }}</td>
        <td>{{ _("Available space:") }}</td>
        <td>{{ freespace }}</td>
<h3>{{ _("pyLoad") }}</h3>
        <td>{{ _("Version:") }}</td>
        <td>{{ version }}</td>
        <td>{{ _("Installation folder:") }}</td>
        <td>{{ folder }}</td>
        <td>{{ _("Config folder:") }}</td>
        <td>{{ config }}</td>
        <td>{{ _("Language:") }}</td>
        <td>{{ language }}</td>
        <td>{{ _("WebUI port:") }}</td>
        <td>{{ webif }}</td>
  <dd class="col-xs-12 col-sm-9">{{config}}</dd>
  <dd class="col-xs-12 col-sm-9">{{config}}</dd>
Fixed code:         "config_folder": api.get_userdir(),
{% block title %}{{_("Information")}} - {{super()}} {% endblock %}
{% block subtitle %}{{_("Information")}}{% endblock %}
<h3>{{_("Support")}}</h3>
<h3>{{_("System")}}</h3>
        <td>{{_("Python version:")}}</td>
        <td>{{python}}</td>
        <td>{{_("OS platform:")}}</td>
        <td>{{os}}</td>
<h3>{{_("Storage")}}</h3>
        <td>{{_("Download folder:")}}</td>
        <td>{{download}}</td>
        <td>{{_("Available space:")}}</td>
        <td>{{freespace}}</td>
<h3>{{_("pyLoad")}}</h3>
        <td>{{_("Version:")}}</td>
        <td>{{version}}</td>
        <td>{{_("Installation folder:")}}</td>
        <td>{{folder}}</td>
        <td>{{_("Config folder:")}}</td>
        <td>{{config_folder}}</td>
        <td>{{_("Language:")}}</td>
        <td>{{language}}</td>
        <td>{{_("WebUI port:")}}</td>
        <td>{{webif}}</td>
  <dd class="col-xs-12 col-sm-9">{{config_folder}}</dd>
  <dd class="col-xs-12 col-sm-9">{{config_folder}}</dd>