pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API

QFinch assessment

The folder /.pyload/scripts has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved. A file can be downloaded to such a folder by changing the download folder to a folder in /scripts path and using the /flashgot API to download the file.

Potential impact

This vulnerability allows an attacker with access to change the settings on a pyload server to execute arbitrary code and completely compromise the system

Technical context

Configuration changes 1. Change the download folder to /home/<user>/.pyload/scripts 2. Change permissions for downloaded files: Making the request to download files The flashgot API provides functionality to download files from a provided URL. Although pyload tries to prevent non-local requests from being able to reach this API, it relies on checking the Host header and the Referer header of the incoming request. Both of these can be set by an attacker to arbitrary values, thereby bypassing these checks. Referer header check Host header check for local check Once the file is downloaded to a folder in the scripts folder, the attacker can perform the respective action, and the script will be executed