cve/2024/CVE-2024-21644.md

CVE-2024-21644

Description

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRET_KEY variable. This issue has been patched in version 0.5.0b3.dev77.

POC

Reference

• https://github.com/pyload/pyload/security/advisories/GHSA-mqpq-2p68-46fv

Github

• https://github.com/fkie-cad/nvd-json-data-feeds
• https://github.com/ltranquility/CVE-2024-21644-Poc
• https://github.com/nomi-sec/PoC-in-GitHub