CVE-2024-39205

Advisory

Affected versions of the pyload-ng package are vulnerable to Code Injection due to improper control of code generation via a JS2PY sandbox escape in the handling of input passed to the `/flash/addcrypted2` API endpoint. The `/flash/addcrypted2` endpoint uses js2py—which suffers from a sandbox escape via CVE-2024-28397—and the endpoint’s localhost restriction can be bypassed using crafted HTTP headers, allowing execution of arbitrary shell commands within the code evaluation context. An attacker can send a request containing a shell command to the `/flash/addcrypted2` endpoint (even remotely by spoofing headers), resulting in remote code execution on the server, with high confidentiality, integrity, and availability impact.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-r9pp-r4xf-597r
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39205