.. / CVE-2024-21644

• Access Control
• Nuclei
• Web

Exploit for pyLoad Flask Config - Access Control (CVE-2024-21644)

Description:

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRET_KEY variable. This issue has been patched in version 0.5.0b3.dev77.

Nuclei Template

View the template here CVE-2024-21644.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2024/CVE-2024-21644.yaml

References: