| タイトル | alexta69 MeTube up to 2026.09.26 Server-Side Request Forgery |
|---|
| 説明 | A vulnerability was found in alexta69 MeTube up to 2026.09.26. The affected function is DownloadQueue.__write_feed_metadata_sync in app/ytdl.py, reached through the POST /add endpoint.
When a playlist or channel URL is added, MeTube writes feed-level metadata in its main process using a plain yt-dlp instance. The feed thumbnail URL is taken from the remote page (og:image) and is therefore attacker-controlled. This URL is never checked by validate_url (which only sees the submitted page URL), and the connect-time socket guard install_socket_guard is installed only in the download subprocess, not in the main process. The server fetches the thumbnail URL and writes the response body into the download directory, which is served by the /download/ route, so the attacker can read the response back.
This results in server-side request forgery with full response read-back, for example against loopback services or cloud metadata endpoints. The attack can be launched remotely. Exploitation requires the instance to have thumbnail writing (writethumbnail) enabled.
CWE-918 (Server-Side Request Forgery). Vendor-assessed severity: 5.9 (Moderate).
The vendor was contacted beforehand, confirmed the issue and published advisory GHSA-hq22-f7w6-p8cr. Upgrading to version 2026.09.29 addresses this issue. No CVE has been assigned.
Product: https://github.com/alexta69/metube |
|---|
| ソース | ⚠️ https://github.com/alexta69/metube/security/advisories/GHSA-hq22-f7w6-p8cr |
|---|
| ユーザー | lijunjie (UID 101496) |
|---|
| 送信 | 2026年10月01日 12:46 (18 日 ago) |
|---|
| モデレーション | 2026年10月18日 15:50 (17 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 421755 [alexta69 MeTube 迄 2026.09.28 Feed-metadata Thumbnail Fetch app/ytdl.py DownloadQueue.__write_feed_metadata_sync 特権昇格] |
|---|
| ポイント | 20 |
|---|