CVE-2023-47890
published 2024-01-08CVE-2023-47890: pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.
PriorityP353high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.06%
64.3th percentile
pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pyload-ng_project | pyload-ng | >= 0 < 0.5.0b3.dev75 | 0.5.0b3.dev75 |
| pyload | pyload | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Download to arbitrary folder can lead to RCE
ghsa·2023-11-21
CVE-2023-47890 [HIGH] CWE-22 Download to arbitrary folder can lead to RCE
Download to arbitrary folder can lead to RCE
### Summary
A web UI user can store files anywhere on the pyLoad server and gain command execution by abusing scripts.
### Details
When a user creates a new package, a subdirectory is created within the /downloads folder to store files. This new directory name is derived from the package name, except a filter is applied to make sure it can't traverse directories and stays within /downloads.
src/pyload/core/api/__init__.py::add_package::L432
```python
folder = (
folder.replace("http://", "")
.replace("https://", "")
.replace(":", "")
.replace("/", "_")
.replace("\\", "_")
)
```
So if a package were created with the name ```"../"``` the application would instead create the folder ```"/downloads/.._/"```
However, when editing packages there
OSV
Download to arbitrary folder can lead to RCE
osv·2023-11-21
CVE-2023-47890 [HIGH] Download to arbitrary folder can lead to RCE
Download to arbitrary folder can lead to RCE
### Summary
A web UI user can store files anywhere on the pyLoad server and gain command execution by abusing scripts.
### Details
When a user creates a new package, a subdirectory is created within the /downloads folder to store files. This new directory name is derived from the package name, except a filter is applied to make sure it can't traverse directories and stays within /downloads.
src/pyload/core/api/__init__.py::add_package::L432
```python
folder = (
folder.replace("http://", "")
.replace("https://", "")
.replace(":", "")
.replace("/", "_")
.replace("\\", "_")
)
```
So if a package were created with the name ```"../"``` the application would instead create the folder ```"/downloads/.._/"```
However, when editing packages there
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-01-08
Published