Vulnerable code sample

import cgi
from functools import wraps
from http.server import BaseHTTPRequestHandler, HTTPServer
import json

# This is a simplified representation of the pyLoad web server and decorator logic.
# It uses the standard library's http.server to avoid external dependencies.

# --- VULNERABLE DECORATOR ---
def local_check(func):
    """
    Vulnerable decorator that checks if the request is from localhost.
    It incorrectly trusts the 'Host' header, which can be spoofed by a remote attacker.
    """
    @wraps(func)
    def wrapper(handler, *args, **kwargs):
        host_header = handler.headers.get('Host', '').split(':')[0]
        
        # The vulnerable check: an attacker can set 'Host: localhost' or 'Host: 127.0.0.1'
        if host_header in ('localhost', '127.0.0.1'):
            return func(handler, *args, **kwargs)
        else:
            # If the header doesn't match, access is forbidden.
            handler.send_response(403)
            handler.send_header('Content-type', 'application/json')
            handler.end_headers()
            handler.wfile.write(json.dumps({'error': 'Access denied'}).encode('utf-8'))
            print(f"[-] Denied access for Host: {host_header} from {handler.client_address[0]}")
    return wrapper

class VulnerablePyloadHandler(BaseHTTPRequestHandler):
    """
    A request handler that simulates pyLoad's web interface,
    including a protected endpoint.
    """
    
    @local_check
    def handle_flash_request(self):
        """
        Simulates the 'flash' endpoint for Click'N'Load, which should be localhost-only.
        This is the function protected by the vulnerable decorator.
        """
        ctype, pdict = cgi.parse_header(self.headers.get('content-type'))
        if ctype == 'application/x-www-form-urlencoded':
            length = int(self.headers.get('content-length'))
            postvars = cgi.parse_qs(self.rfile.read(length), keep_blank_values=1)
            
            # In a real scenario, this data would be used to add downloads
            # and could lead to file writes or other actions.
            jk = postvars.get(b'jk', [b''])[0].decode('utf-8', 'ignore')
            
            print(f"[+] SUCCESS: Accessed protected 'flash' endpoint from {self.client_address[0]}")
            print(f"    -> Spoofed Host header: {self.headers.get('Host')}")
            print(f"    -> Injected JavaScript/Data: {jk}")
            
            self.send_response(200)
            self.send_header('Content-type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({'status': 'ok'}).encode('utf-8'))
        else:
            self.send_response(400)
            self.send_header('Content-type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({'error': 'Bad Request'}).encode('utf-8'))

    def do_POST(self):
        """Handles POST requests and routes to the protected endpoint if the path matches."""
        if self.path == '/flash':
            self.handle_flash_request()
        else:
            self.send_response(404)
            self.end_headers()
            self.wfile.write(b'Not Found')

    def do_GET(self):
        """Handles GET requests to show the server is running."""
        self.send_response(200)
        self.send_header('Content-type', 'text/html')
        self.end_headers()
        self.wfile.write(b"Vulnerable pyLoad Simulation. The protected endpoint is at POST /flash.")

def run(server_class=HTTPServer, handler_class=VulnerablePyloadHandler, port=8000):
    # Bind to 0.0.0.0 to be accessible from remote machines for the demonstration.
    server_address = ('0.0.0.0', port)
    httpd = server_class(server_address, handler_class)
    print(f"Starting vulnerable server on port {port}...")
    print("To exploit, send a POST request to /flash with a spoofed 'Host: localhost' header.")
    print("Example using curl:")
    print("curl -X POST http://<server_ip>:8000/flash -H 'Host: localhost' -d 'jk=alert(1)'")
    httpd.serve_forever()

if __name__ == '__main__':
    run()