-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pyload-ng | pip | < 0.5.0b3.dev91 | 0.5.0b3.dev91 |
Miggo AIRoot Cause AnalysisThe vulnerability analysis identified two primary weaknesses in the pyLoad web interface. The first is a path traversal vulnerability in the Click'N'Load (CNL) blueprint, and the second is a cross-site scripting (XSS) vulnerability in the interactive captcha handler.
Path Traversal in CNL Blueprint (cnl_blueprint.addcrypted): The addcrypted function in src/pyload/webui/app/blueprints/cnl_blueprint.py was responsible for handling encrypted links. It took a package parameter from the user's request and used it to create a .dlc file. The vulnerability existed because the package parameter was not sanitized, allowing an attacker to use directory traversal characters (../) to control the location where the file was saved. This could lead to arbitrary file creation on the server. The patch addresses this by using werkzeug.utils.secure_filename to sanitize the input, ensuring that the filename is safe to use.
XSS in Captcha Handler (window.addEventListener): The captcha-interactive.user.js script, which manages interactive captchas, used window.addEventListener to listen for messages from a parent window. The vulnerability was that the script did not verify the origin of these messages. A malicious website could embed the pyLoad captcha page in an iframe and send it a crafted message, which would then be executed in the context of the pyLoad web UI. This could lead to session hijacking or other malicious actions. The patch mitigates this by checking if the message origin is in a list of trusted origins before processing it.
By exploiting these vulnerabilities, an attacker could either write files to arbitrary locations on the server or execute malicious scripts in a user's browser, leading to a compromise of the pyLoad instance.
Ongoing coverage of React2Shell