Pyload ng: pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

The WindowsPhoneNotify addon in pyLoad-ng uses the http.client.HTTPConnection class to send HTTP POST notifications to a host specified by the plugin's pushurl configuration. A user with the non-admin SETTINGS permission can set pushurl, pushid, and enable the addon via the web API because these options are not restricted to admin users. The addon activates immediately without restart, and any completed download triggers a POST request to the configured host and path. This request bypasses pyLoad's outbound SSRF protections, which only apply to pycurl-based connections, allowing blind SSRF attacks to internal network addresses including loopback, RFC 1918 ranges, and cloud metadata endpoints. The vulnerability arises from insufficient authorization on configuration options and lack of address validation in the HTTP client used by the addon.

An authenticated user with SETTINGS permission can cause the pyLoad server to send blind HTTP POST requests to arbitrary internal hosts and ports that the user cannot access directly. This enables internal network reconnaissance, probing of hosts and ports, and interaction with internal HTTP services that respond to POST requests. Confidentiality and integrity impacts are limited to what can be inferred or triggered via these blind requests; no direct availability impact has been demonstrated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict SETTINGS permission to trusted users only and monitor configuration changes to the WindowsPhoneNotify addon. Consider disabling the WindowsPhoneNotify addon if not required. The vendor advisory does not indicate any official fix or temporary workaround at this time.