cve/2024/CVE-2024-22416.md

### [CVE-2024-22416](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22416)
![](https://img.shields.io/static/v1?label=Product&message=pyload&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%200.5.0b3.dev78%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%3A%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brighgreen)

### Description

pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.

### POC

#### Reference
- https://github.com/pyload/pyload/security/advisories/GHSA-pgpj-v85q-h5fm

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds
- https://github.com/mindstorm38/ensimag-secu3a-cve-2024-22416
- https://github.com/nomi-sec/PoC-in-GitHub