CVE-2023-0509: Improper Certificate Validation (CWE-295)
value: Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 7.4
Published: 2023-01-26T22:15Z
Repository: https://github.com/pyload/pyload
Language: Python
Files changed: src/pyload/core/config/default.cfg, src/pyload/core/network/http/http_request.py, src/pyload/core/network/request_factory.py
Commit date: 2023-01-26 02:42:31 +0200
Commit message: enable SSL certificate verification by default, add option to disable it

Diff: diff --git a/src/pyload/core/config/default.cfg b/src/pyload/core/config/default.cfg
index 5ca85a1053..bd7b0f58c7 100644
--- a/src/pyload/core/config/default.cfg
+++ b/src/pyload/core/config/default.cfg
@@ -5,10 +5,11 @@ general - "General":
     folder storage_folder : "Download folder" = ~/Downloads/pyLoad
     bool debug_mode : "Debug mode" = True
     debug;trace;stack debug_level : "Debug level" = trace
     int min_free_space : "Minimum free space in MiB" = 1024
     bool folder_per_package : "Create folder for each package" = True
+    bool ssl_verify : "Peer's SSL certificate verification" = True
 permission - "Permissions":
     bool change_user : "Change user of running process" = False
     str user : "Username for ownership" = user
     str folder : "Permission mode for created folders" = 0755
     bool change_file : "Change permissions of downloads" = False
diff --git a/src/pyload/core/network/http/http_request.py b/src/pyload/core/network/http/http_request.py
index 05a08b99fb..fe5d099005 100644
--- a/src/pyload/core/network/http/http_request.py
+++ b/src/pyload/core/network/http/http_request.py
@@ -101,22 +101,22 @@ class HTTPRequest:
         self.c.setopt(pycurl.CONNECTTIMEOUT, 30)
         self.c.setopt(pycurl.NOSIGNAL, 1)
         self.c.setopt(pycurl.NOPROGRESS, 1)
         if hasattr(pycurl, "AUTOREFERER"):
             self.c.setopt(pycurl.AUTOREFERER, 1)
-        self.c.setopt(pycurl.SSL_VERIFYPEER, 0)
+        self.c.setopt(pycurl.SSL_VERIFYPEER, 1)
         self.c.setopt(pycurl.LOW_SPEED_TIME, 60)
         self.c.setopt(pycurl.LOW_SPEED_LIMIT, 5)
         if hasattr(pycurl, "USE_SSL"):
             self.c.setopt(pycurl.USE_SSL, pycurl.USESSL_TRY)
 
         # self.c.setopt(pycurl.VERBOSE, 1)
         # self.c.setopt(pycurl.HTTP_VERSION, pycurl.CURL_HTTP_VERSION_1_1)
 
         self.c.setopt(
             pycurl.USERAGENT,
-            b"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36",
+            b"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0",
         )
         if pycurl.version_info()[7]:
             self.c.setopt(pycurl.ENCODING, b"gzip, deflate")
         self.c.setopt(
             pycurl.HTTPHEADER,
@@ -172,10 +172,13 @@ class HTTPRequest:
             self.c.setopt(pycurl.USERPWD, options["auth"])
 
         if "timeout" in options:
             self.c.setopt(pycurl.LOW_SPEED_TIME, int(options["timeout"]))
 
+        if "ssl_verify" in options:
+            self.c.setopt(pycurl.SSL_VERIFYPEER, 1 if options["ssl_verify"] else 0)
+
     def add_cookies(self):
         """
         put cookies from curl handle to cj.
         """
         if self.cj:
diff --git a/src/pyload/core/network/request_factory.py b/src/pyload/core/network/request_factory.py
index 48832554ef..197c39aca2 100644
--- a/src/pyload/core/network/request_factory.py
+++ b/src/pyload/core/network/request_factory.py
@@ -110,10 +110,11 @@ class RequestFactory:
         """
         return {
             "interface": self.iface(),
             "proxies": self.get_proxies(),
             "ipv6": self.pyload.config.get("download", "ipv6"),
+            "ssl_verify": self.pyload.config.get("general", "ssl_verify"),
         }
 
     def update_bucket(self):
         """
         set values in the bucket according to settings.

Vulnerable code:         self.c.setopt(pycurl.SSL_VERIFYPEER, 0)
            b"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36",
Fixed code:     bool ssl_verify : "Peer's SSL certificate verification" = True
        self.c.setopt(pycurl.SSL_VERIFYPEER, 1)
            b"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0",
        if "ssl_verify" in options:
            self.c.setopt(pycurl.SSL_VERIFYPEER, 1 if options["ssl_verify"] else 0)

            "ssl_verify": self.pyload.config.get("general", "ssl_verify"),