PT-2023-16152 · Pypi +1 · Js2Py +1

Gammac0De

·

Published

2023-01-14

·

Updated

2025-08-12

·

CVE-2023-0297

Report an issue
CVSS v3.1
9.8
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

pyload/pyload versions prior to 0.5.0b3.dev31

Description:

The issue concerns a code injection vulnerability in the pyload/pyload GitHub repository. It allows for pre-authentication remote code execution (RCE) due to the integration of JavaScript in Python using the js2py library. Specifically, the `eval js()` function is vulnerable, as it executes JavaScript code passed through the `jk` parameter. This allows attackers to inject arbitrary commands. An example of exploitation is through a POST request to the `/amogus/test` endpoint with malicious `jk` parameter content, such as `jk=pyimport os;os.system("touch /tmp/pwnd");f=function f2(){};`. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations:

For versions prior to 0.5.0b3.dev31, update to version 0.5.0b3.dev31 or later to resolve the issue.

As a temporary workaround, consider restricting access to the `eval js()` function and the `/amogus/test` endpoint until a patch is applied.

Avoid using the `jk` parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-0297
GHSA-PF38-5P22-X6H6

Affected Products

Js2Py
Pyload