CVE-2024-24808

Advisory

Affected versions of pyload are vulnerable to Open Redirection (CWE-601). This vulnerability allows attackers to redirect users to malicious sites by exploiting the improper handling of the next parameter in the login functionality. The attack vector involves crafting URLs with malicious next parameters, leading users to phishing or harmful websites. Vulnerable functions include login in app_blueprint.py and get_redirect_url in helpers.py. To mitigate, upgrade to pyload version which implements proper validation and handling of redirect URLs, preventing unauthorized redirections.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/pyload/pyload/commit/fe94451dcc2be90b3889e2fd9d07b483c8a6dccd
• https://github.com/advisories/GHSA-g3cm-qg2v-2hj5
• https://huntr.com/bounties/eef9513d-ccc3-4030-b574-374c5e7b887e
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24808