Affected: pyload

pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery (SSRF) attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive infrastructure data including droplet ID, network configuration, region, authentication keys, and SSH keys configured in user-data/cloud-init. Version 0.5.0b3.dev97 contains a patch.

Affected: PyPI: pyload-ng

## Summary

PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery (SSRF) attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive infrastructure data including droplet ID, network configuration, region, authentication keys, and SSH keys configured in user-data/cloud-init.

## Details

The vulnerability exists in PyLoad's download package functionality (`/api/addPackage` endpoint), which directly passes user-supplied URLs to the download engine without validating the destination. The affected code in `src/pyload/webui/app/blueprints/api_blueprint.py`:

```python @bp.route("/addPackage", methods=["POST"], endpoint="add_package") @login_required def add_package(): name = flask.request.form["add_name"] links = flask.request.form["add_links"].split("\n") # ... validation omitted ... api.add_package(name, links, dest) # No URL validation ```

The download engine in `src/pyload/core/managers/download.py` accepts any URL scheme and initiates HTTP requests to arbitrary destinations, including internal network addresses and cloud metadata endpoints.

## Proof of Concept **Live Demo Instance:** http://143.244.141.81:8000 **Credentials:** `pyload` / `pyload`

- Login into the pyload application - Navigate to package tab and enter the package name and fill the Link section with the following URL

`…