Vulnerable code sample

import os
from flask import Flask, request

# This is a simplified representation of the pyLoad application core
# for demonstration purposes.
app = Flask(__name__)

# In a real pyLoad instance, this would be a configurable download directory.
DOWNLOAD_FOLDER = "/opt/pyload/downloads/"

@app.route('/addcrypted', methods=['POST'])
def add_crypted_vulnerable():
    """
    This function simulates the vulnerable 'addcrypted' endpoint.
    It receives parameters that would typically come from a CNL (Click'n'Load)
    blueprint.
    """
    # The 'package' parameter is user-controllable and dictates the
    # subfolder for the download.
    package_name = request.form.get('package')
    
    # For demonstration, we assume a static filename and content.
    # In a real scenario, these would also be derived from the request.
    file_to_write = "payload.dat"
    file_content = "# Arbitrary content written by exploit"

    if not package_name:
        return "Error: 'package' parameter is missing.", 400

    # VULNERABLE CODE BLOCK
    # The 'package_name' supplied by the user is directly joined with the
    # base download folder path without any sanitization or validation.
    # An attacker can supply a 'package_name' like '../../../../etc/cron.d/'
    # to traverse out of the intended download directory.
    #
    # For example, os.path.join("/opt/pyload/downloads/", "../../etc/cron.d/")
    # would resolve to a path like "/opt/pyload/etc/cron.d/" which an attacker
    # might still be able to use for further exploitation. With more '..',
    # it can reach the root directory:
    # os.path.join("/opt/pyload/downloads/", "../../../../etc/cron.d/") resolves
    # to "/etc/cron.d/".
    final_path = os.path.join(DOWNLOAD_FOLDER, package_name)
    
    # The full path for the file to be written is constructed.
    target_file = os.path.join(final_path, file_to_write)

    try:
        # The code creates the directory path if it doesn't exist.
        # When 'final_path' is a traversed path like '/etc/cron.d/',
        # this call will ensure that directory exists.
        os.makedirs(os.path.dirname(target_file), exist_ok=True)

        # ARBITRARY FILE WRITE
        # The file is written to the attacker-controlled location.
        # This can be used to write a cron job, a systemd service, a web shell,
        # or overwrite a user's authorized_keys file, leading to RCE.
        with open(target_file, 'w') as f:
            f.write(file_content)
        
        return f"File supposedly written to {target_file}", 200
        
    except (IOError, OSError) as e:
        return f"Error writing file: {e}", 500