CVE-2024-57609 PoC — Pygwalker 安全漏洞

Source

https://github.com/str4ng3r-0x7/CVE-2024-57609

Associated Vulnerability

Title:Pygwalker 安全漏洞 (CVE-2024-57609)
Description:An issue in Kanaries Inc Pygwalker before v.0.4.9.9 allows a remote attacker to obtain sensitive information and execute arbitrary code via the redirect_path parameter of the login redirection function.

Description

Open Redirect Vulnerability in Kanaries

Readme

# Open Redirect Vulnerability in Kanaries
Vendor Homepage: https://kanaries.net/

Poc Video: https://drive.google.com/file/d/1kqfbmx1W6UgSs56gOLOsUFiGcvKrIyW9/view?usp=sharing


## Step-by-Step Exploitation Guide

### 1. Go to the Website
Navigate to the [Kanaries website](https://kanaries.net).

### 2. Initiate Login/Sign Up
- Click on the **"Log in / Sign up"** button on the homepage.
- This redirects you to:https://kanaries.net/access?redirect_path=https%3A%2F%2Fkanaries.net%2Fhome

  
### 3. Modify the Redirect Parameter
- Change the `redirect_path` parameter to a malicious site, such as:
https://kanaries.net/access?redirect_path=https%3A%2F%2Fbing.com

### 4. Trigger the Redirect
- Click on **"Login With GitHub"** or **"Login With Google"** to initiate the login process.
- Instead of being redirected back to the intended page (`kanaries.net`), you are redirected to `bing.com` (or any malicious URL specified in the `redirect_path` parameter).

  # poc image
 ![alt text](https://imgur.com/EIZ4Wq3.png)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!