Description
pyLoad是一款使用纯Python编写的免费开源下载管理器。未经身份验证的用户可以浏览特定的URL以暴露Flask配置，包括SECRET_KEY变量
pyLoad /render/info.html 未授权访问漏洞（CVE-2024-21644）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-21644
https://github.com/pyload/pyload/security/advisories/GHSA-mqpq-2p68-46fv
https://lmboke.com/archives/pyloadwei-shou-quan-fang-wen-lou-dong-cve-2024-21644
https://cn-sec.com/archives/2530111.html
https://www.cvedetails.com/cve/CVE-2024-21644/
https://pentest-tools.com/vulnerabilities-exploits/pyload-flask-config-access-control_22487
https://www.ameeba.com/blog/cve-2024-21644-unauthenticated-exposure-of-flask-config-in-pyload/
https://baishya.xyz/posts/pyload-cves/
https://advisories.gitlab.com/pypi/pyload-ng/CVE-2024-21644/