Vulnerable code sample

#
# This code is a conceptual representation of the vulnerability described in
# a fictitious CVE (CVE-2026-33314). It is intended for educational purposes
# to demonstrate how a Host Header Spoofing vulnerability might work in a
# Python web application context, similar to the one described for pyLoad.
#
# THIS IS NOT THE ACTUAL SOURCE CODE FROM pyLOAD.
#
# Vulnerability details:
# - Product: A hypothetical web application
# - Vulnerability: Host Header Spoofing in an access control decorator.
# - Flaw: The application trusts the client-supplied 'Host' header to determine
#   if a request is from a "local" source.
# - Impact: Attackers can bypass the local-only restriction by setting the
#   'Host' header to a whitelisted value (e.g., 'localhost'), gaining
#   unauthenticated access to protected API endpoints.
#

from functools import wraps
from flask import Flask, request, jsonify

app = Flask(__name__)

# A list of hosts that are considered "local" and allowed to access
# sensitive endpoints. The vulnerability lies in how this list is checked.
ALLOWED_LOCAL_HOSTS = [
    '127.0.0.1:8000',
    'localhost:8000',
]

def local_check(f):
    """
    VULNERABLE DECORATOR: Intended to restrict access to local requests only.
    It incorrectly relies on the 'Host' header provided by the client.
    """
    @wraps(f)
    def decorated_function(*args, **kwargs):
        # VULNERABLE PART: The application reads the 'Host' header directly from
        # the incoming request. An attacker can control this value.
        host_header = request.headers.get('Host')

        print(f"[DEBUG] Checking request with Host header: {host_header}")

        # THE FLAW: The check simply sees if the user-supplied 'Host' header
        # is in the list of allowed hosts. It doesn't verify the actual
        # remote IP address of the request.
        if host_header in ALLOWED_LOCAL_HOSTS:
            # If the header is spoofed to 'localhost:8000', access is granted.
            return f(*args, **kwargs)
        else:
            # If the header is the real IP of the attacker, access is denied.
            print(f"[ACCESS DENIED] Host '{host_header}' not in allowed list.")
            return jsonify({"error": "Access denied. This endpoint is for local access only."}), 403
    return decorated_function


@app.route('/')
def index():
    """A public endpoint that does not require local access."""
    return "Welcome to the Download Manager. The API is at /api/add_download"


@app.route('/api/add_download', methods=['POST'])
@local_check  # This sensitive endpoint is "protected" by the vulnerable decorator.
def add_download():
    """
    A sensitive API endpoint that simulates adding a download link.
    An attacker gaining access here could cause SSRF or DoS.
    """
    data = request.get_json()
    if not data or 'url' not in data:
        return jsonify({"error": "Missing 'url' in request body"}), 400

    url_to_download = data.get('url')

    # In a real scenario, the application would now try to fetch this URL.
    # This is where SSRF (e.g., url='http://169.254.169.254/latest/meta-data') or
    # DoS (e.g., pointing to a massive file) would occur.
    print(f"[SUCCESS] Access granted. Queuing download for: {url_to_download}")

    return jsonify({
        "status": "success",
        "message": f"Download for '{url_to_download}' has been queued."
    }), 200


if __name__ == '__main__':
    # To demonstrate the vulnerability:
    # 1. Run this script: python ./vulnerable_app.py
    # 2. Open a new terminal.
    #
    # 3. Attempt a normal remote request (will be blocked):
    #    curl -X POST http://127.0.0.1:8000/api/add_download \
    #    -H "Content-Type: application/json" \
    #    -d '{"url":"http://example.com/file.zip"}'
    #    -> This will fail with a 403 Forbidden error because the default
    #       Host header is '127.0.0.1:8000' which is allowed. To simulate a
    #       non-local request, you'd run this from a different machine.
    #
    # 4. EXPLOIT: Make a remote request but SPOOF the Host header:
    #    curl -X POST http://127.0.0.1:8000/api/add_download \
    #    -H "Content-Type: application/json" \
    #    -H "Host: localhost:8000" \
    #    -d '{"url":"http://internal-service/resource"}'
    #    -> This will succeed with a 200 OK because the server trusts the
    #       spoofed "Host: localhost:8000" header, bypassing the check.
    #       The server will then attempt to download from the provided URL,
    #       leading to SSRF.

    print("Starting vulnerable server on http://0.0.0.0:8000")
    # Bind to 0.0.0.0 to simulate a server accessible from the outside.
    app.run(host='0.0.0.0', port=8000)