CVE-2024-22416 (published 2024-01-18T00:15Z)

pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/pyload/pyload
commit_details: repo_url: https://github.com/pyload/pyload
author: GammaC0de
author_date: 2024-01-18 01:11:24+02:00
msg: fix GHSA-pgpj-v85q-h5fm security advisory (2)
repository: repo_url: https://github.com/pyload/pyload
repo_name: pyload/pyload
description: The free and open-source Download Manager written in pure Python
repo_language: Python
owner: pyload
file_changes: filename: __init__.py
change_type: ModificationType.MODIFY
diff: @@ -112,7 +112,7 @@ class App:
         app.config["SESSION_FILE_DIR"] = cache_path
         app.config["SESSION_TYPE"] = "filesystem"
         app.config["SESSION_COOKIE_NAME"] = "pyload_session"
-        app.config["SESSION_COOKIE_SAMESITE"] = "None"
+        app.config["SESSION_COOKIE_SAMESITE"] = "Strict"
         app.config["SESSION_COOKIE_SECURE"] = app.config["PYLOAD_API"].get_config_value("webui", "use_ssl")
         app.config["SESSION_PERMANENT"] = False
 

programming_language: Python
repo_url: https://github.com/pyload/pyload
commit_details: repo_url: https://github.com/pyload/pyload
author: GammaC0de
author_date: 2024-01-18 00:56:58+02:00
msg: fix GHSA-pgpj-v85q-h5fm security advisory
repository: repo_url: https://github.com/pyload/pyload
repo_name: pyload/pyload
description: The free and open-source Download Manager written in pure Python
repo_language: Python
owner: pyload
file_changes: filename: setup.cfg
change_type: ModificationType.MODIFY
diff: @@ -66,13 +66,12 @@ package_dir =
     = src
 install_requires =
     Cheroot~=8.4
-    Flask;python_version<"3.8"
-    Flask~=2.3.0;python_version>="3.8"
+    Flask
     Flask-Babel~=1.0
     Flask-Caching~=1.9
     Flask-Compress~=1.8
-    Flask-Session~=0.3;python_version<"3.7"
-    Flask-Session2~=1.3;python_version>="3.7"
+    Flask-Session~=0.4.1;python_version<"3.7"
+    Flask-Session;python_version>="3.7"
     Flask-Themes2~=1.0
     bitmath~=1.3
     cryptography>=35.0.0;platform_python_implementation!="PyPy"

programming_language: Python
filename: __init__.py
change_type: ModificationType.MODIFY
diff: @@ -112,6 +112,7 @@ class App:
         app.config["SESSION_FILE_DIR"] = cache_path
         app.config["SESSION_TYPE"] = "filesystem"
         app.config["SESSION_COOKIE_NAME"] = "pyload_session"
+        app.config["SESSION_COOKIE_SAMESITE"] = "None"
         app.config["SESSION_COOKIE_SECURE"] = app.config["PYLOAD_API"].get_config_value("webui", "use_ssl")
         app.config["SESSION_PERMANENT"] = False
 

programming_language: Python