CVE-2024-22416: Pyload-ng CSRF Vulnerability

CVE-2024-22416 Overview

CVE-2024-22416 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting pyLoad, a free and open-source download manager written in Python. The flaw exists because the pyLoad API allows any call to be made using HTTP GET requests, while the session cookie is not configured with SameSite: Strict. An attacker can craft a malicious web page that triggers arbitrary API calls against an authenticated pyLoad instance when the victim visits the page. The issue was fixed in release 0.5.0b3.dev78 by setting the session cookie to SameSite=Strict.

Critical Impact
An attacker can invoke any pyLoad API call on behalf of an authenticated user, enabling full takeover of the download manager including arbitrary configuration changes and command execution paths exposed by the API.

Affected Products

pyLoad (pyload-ng) versions prior to 0.5.0b3.dev78
All pyLoad webUI deployments using default Flask session cookie configuration
Python-based installations of pyload-ng from the pyload-ng_project

Discovery Timeline

2024-01-18 - CVE-2024-22416 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-22416

Vulnerability Analysis

pyLoad exposes a JSON-RPC style API through its Flask-based webUI. Every API call can be invoked via an HTTP GET request, which means parameters travel in the URL and the request can be triggered by any HTML element capable of issuing cross-origin GET traffic, such as <img>, <script>, or <iframe> tags.

The Flask session cookie used to authenticate webUI users was configured with SESSION_COOKIE_SAMESITE = "None". Browsers therefore attached the cookie to cross-site requests, allowing a malicious page to make authenticated API calls when a logged-in pyLoad user visited it. Combined with GET-based state-changing actions, this produces a classic Cross-Site Request Forgery condition.

Because the API surface includes administrative functionality, a successful CSRF can modify settings, add or remove downloads, or trigger features that lead to further compromise of the host running pyLoad.

Root Cause

Two design choices combined to create the vulnerability. First, the API accepts state-changing operations through GET requests without anti-CSRF tokens. Second, the session cookie was issued with SameSite=None, instructing the browser to send the cookie on cross-origin requests.

Attack Vector

The attack requires an authenticated pyLoad user to visit attacker-controlled content. The attacker hosts a page that issues cross-origin GET requests to the victim's pyLoad instance, for example by embedding an image tag pointing to http://victim-host:8000/api/<method>?arg=<value>. The browser attaches the session cookie, and pyLoad executes the call.

python

        app.config["SESSION_FILE_DIR"] = cache_path
        app.config["SESSION_TYPE"] = "filesystem"
        app.config["SESSION_COOKIE_NAME"] = "pyload_session"
-       app.config["SESSION_COOKIE_SAMESITE"] = "None"
+       app.config["SESSION_COOKIE_SAMESITE"] = "Strict"
        app.config["SESSION_COOKIE_SECURE"] = app.config["PYLOAD_API"].get_config_value("webui", "use_ssl")
        app.config["SESSION_PERMANENT"] = False

Source: pyload commit 1374c82 — the patch changes SESSION_COOKIE_SAMESITE from None to Strict in src/pyload/webui/app/__init__.py, preventing the browser from sending the pyload_session cookie on cross-site requests.

Detection Methods for CVE-2024-22416

Indicators of Compromise

Unexpected pyLoad API calls in webUI access logs originating from external Referer headers or unusual user-agent strings.
Configuration changes to pyLoad (added downloaders, modified paths, altered credentials) without a corresponding administrative session.
New or unexpected files appearing in pyLoad's download directories that were not initiated by the operator.

Detection Strategies

Inspect webUI HTTP access logs for GET requests to /api/ endpoints carrying a valid session cookie but a cross-origin Referer value.
Compare the running pyLoad version string against 0.5.0b3.dev78; any earlier version is vulnerable.
Review the running Flask configuration and confirm whether SESSION_COOKIE_SAMESITE resolves to Strict at runtime.

Monitoring Recommendations

Forward pyLoad webUI access logs to a central logging system and alert on bursts of API calls following a user click event from an external site.
Monitor outbound network connections from the pyLoad host for downloads to attacker-controlled URLs that were not user-initiated.
Audit the pyLoad configuration file periodically for unauthorized changes to download paths, plugins, or remote credentials.

How to Mitigate CVE-2024-22416

Immediate Actions Required

Upgrade pyload-ng to release 0.5.0b3.dev78 or later, which sets SESSION_COOKIE_SAMESITE to Strict.
Restrict access to the pyLoad webUI by binding it to localhost or to a trusted internal network, and place it behind a reverse proxy that enforces authentication.
Log out of the pyLoad webUI when not in active use, and avoid browsing untrusted websites in the same browser session.

Patch Information

The fix is delivered in two commits to the pyLoad repository. Commit 1374c82 sets SESSION_COOKIE_SAMESITE = "Strict" in src/pyload/webui/app/__init__.py. Commit c7cdc18 updates Flask and Flask-Session dependency pinning in setup.cfg to support the SameSite configuration. Full details are documented in the GitHub Security Advisory GHSA-pgpj-v85q-h5fm.

Workarounds

If upgrading is not immediately possible, place pyLoad behind a reverse proxy (such as nginx) and require an additional authentication layer that uses SameSite=Strict cookies.
Restrict network exposure of the webUI by binding it to 127.0.0.1 and accessing it only through SSH port forwarding.
Use a dedicated browser or browser profile for pyLoad administration to limit the chance of visiting an attacker-controlled page while authenticated.

bash

# Upgrade pyload-ng to a fixed release
pip install --upgrade 'pyload-ng>=0.5.0b3.dev78'

# Verify the installed version
python -c "import pyload; print(pyload.__version__)"