Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the @local_check decorator located in src/pyload/webui/app/blueprints/cnl_blueprint.py. This decorator is responsible for ensuring that the Click'N'Load API endpoints can only be accessed from the local machine. The vulnerability is caused by an improper origin validation check within this decorator.
The vulnerable code checks both the request's source IP address (remote_addr) and the Host header (http_host) in a single if statement with an or condition. An external attacker can spoof the Host header in their request to a value like 127.0.0.1:9666. This satisfies the second part of the or condition, causing the check to pass and granting the attacker access, regardless of their actual IP address.
This bypass allows unauthenticated attackers to access several functions decorated with @local_check, including add, addcrypted, and addcrypted2. These functions process user-provided URLs and add them to the pyload download queue. By submitting malicious URLs, an attacker can cause the server to make requests to arbitrary internal or external resources, leading to Server-Side Request Forgery (SSRF). They can also cause a Denial of Service (DoS) by queueing a large number of downloads or very large files.
The functions flashgot and checksupport are also affected, allowing for similar SSRF/DoS attacks and information disclosure about the server's network capabilities. The index function is also exposed, but with a lower direct impact.
A runtime profile during exploitation would show a call to the local_check decorator's wrapper function, followed by a call to one of the exposed endpoint functions like add.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pyload-ng | pip | <= 0.5.0b3.dev96 | 0.5.0b3.dev97 |
