CVE-2024-24808: Pyload Open Redirect Vulnerability

CVE-2024-24808 Overview

pyLoad is an open-source download manager written in pure Python. CVE-2024-24808 is an open redirect vulnerability [CWE-601] caused by incorrect validation of user-supplied input during the post-login redirect flow. The get_redirect_url function fails to properly validate the next parameter, allowing attackers to craft URLs that redirect authenticated users to attacker-controlled destinations. This flaw enables phishing campaigns and credential harvesting by abusing the trust users place in the pyLoad domain. The maintainers patched the issue in commit fe94451.

Critical Impact
Attackers can craft malicious login URLs that redirect authenticated pyLoad users to external phishing sites, facilitating credential theft and downstream account compromise.

Affected Products

pyLoad (pyload/pyload) versions prior to the patched commit fe94451
Deployments exposing the pyLoad web UI login endpoint
Installations relying on the vulnerable get_redirect_url helper in app_blueprint.py

Discovery Timeline

2024-02-06 - CVE-2024-24808 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24808

Vulnerability Analysis

The vulnerability resides in the pyLoad web UI login handler. When a user authenticates, the application reads a next parameter from the request and issues an HTTP redirect to that URL. Because the get_redirect_url helper does not enforce that the resolved target belongs to the pyLoad application, an attacker can supply an absolute external URL as next and have the browser redirect to it after successful login. Open redirects (Open Redirect / URL Redirection to Untrusted Site) are commonly chained with phishing to lend legitimacy to malicious links, and they can bypass link filters that whitelist trusted domains such as the pyLoad host.

Root Cause

The root cause is missing origin validation in src/pyload/webui/app/helpers.py and its consumers in src/pyload/webui/app/blueprints/app_blueprint.py. The pre-patch code accepted a fallback URL constructed via flask.url_for and returned externally supplied redirect targets without confirming that the target resolved to an internal endpoint. The patch changes the fallback to an endpoint name ("app.dashboard") and reworks the helper to rely on urljoin, urlparse, and werkzeug.routing.exceptions to reject unsafe targets.

Attack Vector

Exploitation requires user interaction: a victim must click a crafted link that points at the pyLoad login page with a malicious next parameter. After the victim authenticates, pyLoad redirects the browser to the attacker-controlled URL, which typically mimics the pyLoad UI to capture credentials or serve malware.

python

# Security patch in src/pyload/webui/app/blueprints/app_blueprint.py
 def login():
     api = flask.current_app.config["PYLOAD_API"]
 
-    next = get_redirect_url(fallback=flask.url_for("app.dashboard"))
+    next_url = get_redirect_url(fallback="app.dashboard")
 
     if flask.request.method == "POST":
         user = flask.request.form["username"]

# Security patch in src/pyload/webui/app/helpers.py
 import json
 from functools import wraps
-from urllib.parse import unquote, urljoin, urlparse
+from urllib.parse import urljoin, urlparse
 
 import flask
 import flask_themes2
+import werkzeug.routing.exceptions
 from pyload.core.api import Perms, Role, has_permission

Source: pyload commit fe94451

Detection Methods for CVE-2024-24808

Indicators of Compromise

Login requests to /login containing a next parameter with an absolute URL or scheme (for example next=https://attacker.tld).
HTTP 302 responses from the pyLoad host with a Location header pointing to an external domain.
Referrer chains where users transit from the pyLoad login page to unrelated external hosts shortly after authentication.

Detection Strategies

Inspect web server and reverse-proxy logs for next= query values that decode to off-host URLs.
Alert on redirects issued by the pyLoad application where the Location header host differs from the pyLoad service host.
Correlate phishing reports and email gateway telemetry with clicks on pyLoad login URLs containing suspicious query strings.

Monitoring Recommendations

Forward pyLoad access logs to a centralized log platform and build queries for anomalous next parameters.
Monitor outbound redirects from any authenticated web application to domains outside the organization's allow-list.
Track user reports of unexpected redirects after logging into pyLoad and investigate matching sessions.

How to Mitigate CVE-2024-24808

Immediate Actions Required

Upgrade pyLoad to a release that includes commit fe94451 or later.
Restrict access to the pyLoad web UI to trusted networks or via VPN until the patch is applied.
Educate users to inspect the domain of pyLoad login links, especially those received via email or chat.

Patch Information

The fix is delivered in pyLoad commit fe94451, referenced in GitHub Security Advisory GHSA-g3cm-qg2v-2hj5. The patch replaces the caller-supplied fallback URL with an endpoint name and validates redirect targets using urljoin, urlparse, and werkzeug.routing.exceptions so that only internal routes are accepted.

Workarounds

Place pyLoad behind a reverse proxy that strips or validates the next query parameter on the login endpoint.
Configure web application firewall rules to block login requests whose next value contains a scheme (http://, https://) or a host component.
Disable external access to the login page and require authentication through a trusted single sign-on gateway.

bash

# Example NGINX rule to block absolute URLs in the login next parameter
location = /login {
    if ($arg_next ~* "^(https?:)?//") {
        return 400;
    }
    proxy_pass http://pyload_upstream;
}