CVE-2024-47821: 
Python vulnerability analysis and mitigation

CVE-2024-47821 affects pyLoad, a free and open-source Download Manager, discovered in October 2024. The vulnerability exists in versions prior to 0.5.0b3.dev87, where the /.pyload/scripts folder contains scripts that are executed when certain actions are completed, such as when a download finishes (GitHub Advisory).

The vulnerability stems from the ability to manipulate the download folder settings to point to the /scripts path and utilize the /flashgot API to download malicious files. While pyLoad attempts to prevent non-local requests by checking the Host header and Referer header, these security measures can be bypassed as attackers can set arbitrary values for both headers. The vulnerability has received a CVSS v3.1 base score of 9.1 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (GitHub Advisory).

The vulnerability enables an attacker with access to change the settings on a pyload server to execute arbitrary code and completely compromise the system. This allows for full system compromise through remote code execution capabilities (GitHub Advisory).

Exploitation requires changing the download folder to /home//.pyload/scripts and modifying permissions for downloaded files. An attacker can then use the /flashgot API to download malicious files by bypassing local request checks through manipulation of the Host and Referer headers. Once a malicious file is downloaded to the scripts folder, it will be executed when the corresponding action is triggered (GitHub Advisory).

The vulnerability has been patched in version 0.5.0b3.dev87. Users should upgrade to this version or later to mitigate the risk (GitHub Advisory).