GHSA-68w4-83fh-f2w8

pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

Published

2026-10-09

Modified

2026-10-09

Sources

github-advisory

Summary

## Summary `Api.getUserData` (legacy) and `Api.get_userdata` are declared with `@permission(Perms.ANY)` and are reachable at `/api/getUserData` and `/api/get_userdata`. Because `Perms.ANY == 0` and pyLoad's permission check is a bitmask AND, that gate is a no-op: **every authenticated account passes, including one holding zero permission bits.** Both methods are thin wrappers around `check_auth()`, which the maintainers deliberately restricted to administrators by omitting `@permission` (no entry in `perm_map`, so `is_authorized()` returns `False` for non-admins). The wrappers undo that protection. An attacker holding the lowest-privileged account in the system therefore has a clean binary oracle on the **administrator password**, with no account lockout anywhere in the codebase, and with the 100 req/min rate limiter bypassable by rotating `X-Forwarded-For`. ## Affected code `src/pyload/core/api/__init__.py:1446` and `:1464` ```python #: Old API @permission(Perms.ANY) @get def getUserData(self, username: str, password: str) -> OldUserData: """ similar to `check_auth` but returns UserData type. """ user = self.check_auth(username, password) ... @permission(Perms.ANY) @get def get_userdata(self, username: str, password: str) -> UserData: user = self.check_auth(username, password) ... ``` ## Root cause `src/pyload/core/api/__init__.py:57` ```python class Perms(IntFlag): ANY = 0 #: requires no permission, but login ``` `src/pyload/core/api/__init__.py:108` ```python def has_permission(user_perms: Perms, required_perms: Perms): return required_perms == (user_perms & required_perms) ``` For `required_perms == 0` this evaluates to `0 == (user_perms & 0)` → `0 == 0` → **always `True`**. The `@permission(Perms.ANY)` gate therefore admits every authenticated principal regardless of which permission bits they hold. Contrast with the intended admin-only primitive, `src/pyload/core/api/__init__.py:1396`: ```python @legacy("checkAuth") @get def check_auth(self, username: str, password: str) -> dict[str, Any]: ``` `check_auth` has **no** `@permission`; `is_authorized()` at `api/__init__.py:1430` returns `False` for non-admins. The two wrappers carry `Perms.ANY` and restore access for everyone. Because both wrappers also carry `@get`, they are placed in `method_map` and are directly routable via `/api/ `. ## Amplifiers **1. No lockout.** There is no failed-login counter, delay, or ban anywhere in the codebase. A failed guess costs the attacker only one PBKDF2 computation. **2. Rate limiting is bypassable.** `/api/*` applies `rate_limit(count=100, period=60)` (`src/pyload/webui/app/blueprints/api_blueprint.py:25`), which buckets on a fully client-controlled header (`src/pyload/webui/app/helpers.py:446`): ```python client_ip = flask.request.headers.get("X-Forwarded-For", "").split(",")[0].strip() \ or flask.request.remote_addr ``` Rotating `X-Forwarded-For` per request yields a fresh bucket each time. Notably, `is_loopback_request()` in the **same file** (`helpers.py:288-294`) explicitly treats the presence of `X-Forwarded-For` / `X-Real-IP` / `Forwarded` as untrustworthy — the same guard was evidently not applied inside `rate_limit()`. ## Impact Online brute force of the administrator account leading to full administrative takeover. A successful response additionally discloses the target account's `id`, `name`, `email`, `role`, and `permission` bits. ## Proof of concept Verified against 0.5.0b3, commit `a5b008958`. Setup: stock instance with admin `pyload`, plus a non-admin user `bob` created with `role=USER` and `permission=0`. **Step 1 — establish that `bob` is genuinely unprivileged:** ``` GET /api/checkAuth?username=pyload&password=pyload -> 401 {"error": "Access denied"} GET /api/getAllUserData -> 401 {"error": "Access denied"} ``` **Step 2 — the flaw. Same user, s

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-68w4-83fh-f2w8