CVE-2024-39205
published 2024-10-28CVE-2024-39205: An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request.
PriorityP273critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
16.51%
96.6th percentile
An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pyload-ng_project | pyload-ng | 0 – 0.5.0b3.dev85 | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS pyLoad Remote Code Execution via js2py Sandbox Escape (CVE-2024-39205)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/flash/addcrypted2"; fast_pattern; http.host.raw; content:"|3a|9666"; pcre:"/(?:127.0.0.1|\x5b\x3a{2}1\x5d)\x3a9666/"; http.request_body; content:"crypted|3d|"; content:"jk|3d|"; content:"Object.getOwnPropertyNames"; distance:0; content:"__class__"; distance:0; content:"__base__"; distance:0; content:"__getattribute__"; distance:0; reference:url,github.com/Marven11/CVE-2024-39205-Pyload-RCE; reference:cve,2024-39205; classtype:web-application-attack; sid:2057703; rev:1; metadata:attack_target Server, tls_state TLSDecrypt, created_at 2024_11_18, cve CVE_2024_39205, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Exploit, updated_at 2024_11_18, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)- →The exploit targets the /flash/addcrypted2 endpoint via HTTP POST. This endpoint was intended to only accept localhost connections; attackers bypass this restriction by manipulating the Host header to include 127.0.0.1:9666 or [::1]:9666. ↗
- →POST request body to /flash/addcrypted2 will contain the parameters 'crypted=' and 'jk=' with embedded js2py sandbox escape strings including Object.getOwnPropertyNames, __class__, __base__, and __getattribute__.
- →The Host header in the malicious request will contain ':9666' and match the pattern 127.0.0.1:9666 or [::1]:9666, which is the default pyload listening address/port.
- →The attack chains CVE-2024-39205 (pyload endpoint exposure) with CVE-2024-28397 (js2py <=0.74 sandbox escape). Presence of js2py <=0.74 on a host running pyload <=0.5.0b3.dev85 under Python <=3.11 indicates exploitability. ↗
- ·The Snort/ET rule requires TLS decryption (deployment SSLDecrypt / tls_state TLSDecrypt) to inspect encrypted traffic for this exploit.
- ·No patch for js2py (CVE-2024-28397) had been released at time of writing; version 0.74 (released Nov 6, 2022) remains the latest and is vulnerable. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa5.3MEDIUM
osv5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
pyload-ng vulnerable to RCE with js2py sandbox escape
osv·2024-09-09·CVSS 5.3
CVE-2024-39205 [MEDIUM] pyload-ng vulnerable to RCE with js2py sandbox escape
pyload-ng vulnerable to RCE with js2py sandbox escape
### Summary
Any pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately.
### Details
js2py has a vulnerability of sandbox escape assigned as [CVE-2024-28397](https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape), which is used by the `/flash/addcrypted2` API endpoint of pyload-ng. Although this endpoint is designed to only accept localhost connection, we can bypass this restriction using HTTP Header, thus accessing this API and achieve RCE.
### PoC
The PoC is provided as `poc.py` below, you can modify the shell command it execute:
```python
import socket
import base64
from urllib.parse import quote
ho
GHSA
pyload-ng vulnerable to RCE with js2py sandbox escape
ghsa·2024-09-09·CVSS 5.3
CVE-2024-39205 [MEDIUM] CWE-94 pyload-ng vulnerable to RCE with js2py sandbox escape
pyload-ng vulnerable to RCE with js2py sandbox escape
### Summary
Any pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately.
### Details
js2py has a vulnerability of sandbox escape assigned as [CVE-2024-28397](https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape), which is used by the `/flash/addcrypted2` API endpoint of pyload-ng. Although this endpoint is designed to only accept localhost connection, we can bypass this restriction using HTTP Header, thus accessing this API and achieve RCE.
### PoC
The PoC is provided as `poc.py` below, you can modify the shell command it execute:
```python
import socket
import base64
from urllib.parse import quote
ho
Suricata
ET WEB_SPECIFIC_APPS pyLoad Remote Code Execution via js2py Sandbox Escape (CVE-2024-39205)
suricata·2024-11-18·CVSS 9.8
CVE-2024-39205 [CRITICAL] ET WEB_SPECIFIC_APPS pyLoad Remote Code Execution via js2py Sandbox Escape (CVE-2024-39205)
ET WEB_SPECIFIC_APPS pyLoad Remote Code Execution via js2py Sandbox Escape (CVE-2024-39205)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS pyLoad Remote Code Execution via js2py Sandbox Escape (CVE-2024-39205)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/flash/addcrypted2"; fast_pattern; http.host.raw; content:"|3a|9666"; pcre:"/(?:127.0.0.1|\x5b\x3a{2}1\x5d)\x3a9666/"; http.request_body; content:"crypted|3d|"; content:"jk|3d|"; content:"Object.getOwnPropertyNames"; distance:0; content:"__class__"; distance:0; content:"__base__"; distance:0; content:"__getattribute__"; distance:0; reference:url,github.com/Marven11/CVE-2024-39205-Pyload-RCE; reference:cve,2024-39205; classtype:web-application-attack; sid:2057703; rev:1; metadata:attac
2024-10-28
Published