An authenticated Server-Side Request Forgery vulnerability in pyLoad enables attackers to exfiltrate local files and scan internal network infrastructure.

The parse_urls API function fails to perform adequate URL validation or protocol restriction, allowing an authenticated user with ADD permissions to conduct Server-Side Request Forgery (SSRF) attacks. This allows the attacker to interact with internal services, cloud metadata endpoints, and the local file system using protocols like file://, gopher://, and dict://.

Successful exploitation allows an attacker to bypass perimeter security to access sensitive internal services or read local files from the host server. Given the CVSS score of 7.7, this vulnerability represents a high risk, as it facilitates lateral movement and potential data exfiltration, which could lead to severe organizational security breaches.

Immediate Action: As no official patched version is currently available, administrators should immediately restrict access to the pyLoad API to trusted users only and implement strict network egress filtering to prevent the application from reaching internal resources.

Proactive Monitoring: Monitor server access logs for anomalous requests to the parse_urls endpoint and look for outbound connection attempts from the pyLoad server to internal IP addresses or sensitive cloud metadata endpoints (e.g., 169.254.169.254).

Compensating Controls: Deploy a Web Application Firewall to block requests containing suspicious protocol schemes or attempts to access restricted internal network ranges.

Public Exploit Available: Unknown.

Due to the high severity of this SSRF vulnerability and the presence of a proof-of-concept, immediate defensive action is required. Organizations must prioritize limiting network visibility for the pyLoad instance and auditing user permissions until a vendor-supplied patch is released.