| Titre | marcopiovanello yt-dlp-web-ui 4 Command Injection |
|---|
| Description | A default deployment (no config.yml → require_auth=false, bound to x.x.x.x:3033) allows unauthenticated remote code execution as root via the params array of POST /api/v1/exec.
1. main.go sets authentication.require_auth default to false; auth middleware in server/rest/container.go / server/rpc/container.go is skipped unless enabled.
2. User-supplied params reach yt-dlp nearly verbatim (server/internal/downloaders/generic.go, argsSanitizer in server/internal/downloaders/utils.go only strips ${ and &&).
3. --no-exec is placed before user params, so it doesn't help: it only clears --exec (store_const, dest='exec_cmd'), it never touches --exec-before-download (dest='exec_before_dl_cmd, merged into exec_cmd['before_dl'] in yt-dlp's __init__.py), and a later --exec overrides it (last-wins).
PoC (single unauthenticated request, runs as root in the container):
curl -X POST http://target:3033/api/v1/exec -H 'Content-Type: application/json' \
-d '{"url":"https://www.youtube.com/watch?v=dQw4w9WgXcQ",
"params":["--exec-before-download","id > /downloads/pwned.txt; exit 0; "]}'
|
|---|
| La source | ⚠️ https://github.com/marcopiovanello/yt-dlp-web-ui/commit/c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 |
|---|
| Utilisateur | HLever (UID 100450) |
|---|
| Soumission | 22/08/2026 00:00 (il y a 28 jours) |
|---|
| Modérer | 17/09/2026 21:28 (27 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 406851 [marcopiovanello yt-dlp-web-ui jusqu’à v4 generic.go NewGenericDownload params élévation de privilèges] |
|---|
| Points | 20 |
|---|