N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-fj52-5g4h-gmq8

GHSA-fj52-5g4h-gmq8: pyLoad's Session Not Invalidated After Permission Changes

Summary

The pyload application does not properly invalidate or modify sessions upon changes made to a user's permissions.

Details

Whenever an administrator changes the permissions a specific account has, they do not expect that account still being able to access data that their new permissions do not allow. This is not the case for the pyload application, as a user with a valid session can still perform the actions.

PoC

Take a user with all the permissions, as shown below.

We now log in as this user.

Let us now take away all the permissions.

The logged in session can still be used to access everything in the application.

Impact

Should permissions be taken away, then the user is expected not to be able to execute the actions belonging to those actions anymore.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-fj52-5g4h-gmq8

GHSA-fj52-5g4h-gmq8:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pyload-ng	pip	<= 0.5.0b3.dev97

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from pyLoad's failure to invalidate active user sessions after critical account modifications, such as password changes, permission updates, or user deletions. This allows a user's session to retain its original privileges even after they have been revoked by an administrator. The analysis of the provided patch, commit e95804fb0d06cbb07d2ba380fc494d9ff89b68c1, reveals the exact locations where this logic was missing. The functions change_password and update_users within src/pyload/webui/app/blueprints/json_blueprint.py were identified as vulnerable. The patch rectifies this by introducing calls to a new clear_all_user_sessions function whenever a user's password is changed, their permissions are altered, or their account is deleted. These functions are the entry points for the actions that should have triggered session invalidation, and their modification in the patch serves as direct evidence of the vulnerability.

Vulnerable functions

change_password

src/pyload/webui/app/blueprints/json_blueprint.py

This function was responsible for changing a user's password. Before the patch, it did not invalidate the user's existing sessions after a successful password change. This would allow an attacker who has stolen a session to maintain access even after the legitimate user changes their password. The patch adds a call to `clear_all_user_sessions` to mitigate this.

update_users

src/pyload/webui/app/blueprints/json_blueprint.py

This function handles updating user information, including permissions and user deletion. The vulnerability existed because when an administrator changed a user's permissions or deleted a user, their active sessions were not terminated. This allowed a user to continue using the application with their previous privileges. The patch introduces logic to detect changes in permissions (`was_changed`) and calls `clear_all_user_sessions` for the affected user when their permissions are modified or their account is deleted.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.