Listen to this Post
How the CVE Works
The vulnerability stems from pyLoad’s unsafe handling of CAPTCHA responses in the `onCaptchaResult()` function. The function directly passes user-supplied input into eval(), enabling arbitrary JavaScript execution. Attackers can craft malicious CAPTCHA responses containing JavaScript payloads (e.g., `fetch()` or `child_process.exec()` in NodeJS environments). This allows session hijacking, credential theft, and potential remote code execution (RCE) on the backend if the server environment permits it. The lack of input sanitization or validation makes exploitation trivial.
DailyCVE Form
Platform: pyLoad
Version: 0.4.20
Vulnerability: Client-Side RCE
Severity: Critical
Date: 2023-01-10
Prediction: Patch by 2023-02-15
What Undercode Say
git clone https://github.com/pyload/pyload cd pyload git checkout 0.4.20 python -m pip install -e . pyload --userdir=/tmp/pyload
eval(result); // Unsafe execution
curl -X POST "http://localhost:8000/interactive/captcha" -d "cid=123&response=1%3Balert(document.cookie)"
How Exploit
- Craft malicious CAPTCHA response
- Send POST to `/interactive/captcha`
– Execute arbitrary JS/RCE
Protection from this CVE
- Disable vulnerable endpoint
- Sanitize CAPTCHA input
- Replace `eval()`
Impact
- Session hijacking
- Credential theft
- Full system compromise
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
