Listen to this Post
How the CVE Works
The vulnerability in pyLoad (CVE-2023-0297) stems from insufficient sanitization of user-supplied filenames in the `/json/upload` endpoint. An authenticated attacker can manipulate the `filename` parameter to include path traversal sequences (../../), allowing arbitrary file writes outside the intended upload directory. Since pyLoad runs with system-level privileges, this flaw can lead to remote code execution (RCE) by overwriting critical system files (e.g., cron jobs, SSH keys). The vulnerable code in `json_blueprint.py` concatenates the unsanitized `filename` with the storage path, enabling directory traversal.
DailyCVE Form
Platform: pyLoad
Version: <= 0.4.20
Vulnerability: Path Traversal
Severity: Critical
Date: 2023-01-10
Prediction: Patch by Q1 2023
What Undercode Say
Exploit setup git clone https://github.com/pyload/pyload cd pyload git checkout 0.4.20 pip install -e . Malicious upload curl -b cookies.txt -X POST http://localhost:8000/json/upload \ -F "file=@exploit;filename=../../../../etc/cron.d/backdoor"
How Exploit
1. Authenticate to pyLoad.
2. Craft a malicious file (e.g., cron job).
3. Upload with traversal filename.
4. Trigger payload execution.
Protection from this CVE
- Update to patched version.
- Sanitize filenames.
- Restrict upload directory permissions.
Impact
- Remote Code Execution (RCE).
- System compromise.
- Persistent backdoors.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
