| 제목 | alexta69 MeTube up to 2026.09.26 Server-Side Request Forgery |
|---|
| 설명 | A vulnerability was found in alexta69 MeTube up to 2026.09.26. The affected function is DownloadQueue.__write_feed_metadata_sync in app/ytdl.py, reached through the POST /add endpoint.
When a playlist or channel URL is added, MeTube writes feed-level metadata in its main process using a plain yt-dlp instance. The feed thumbnail URL is taken from the remote page (og:image) and is therefore attacker-controlled. This URL is never checked by validate_url (which only sees the submitted page URL), and the connect-time socket guard install_socket_guard is installed only in the download subprocess, not in the main process. The server fetches the thumbnail URL and writes the response body into the download directory, which is served by the /download/ route, so the attacker can read the response back.
This results in server-side request forgery with full response read-back, for example against loopback services or cloud metadata endpoints. The attack can be launched remotely. Exploitation requires the instance to have thumbnail writing (writethumbnail) enabled.
CWE-918 (Server-Side Request Forgery). Vendor-assessed severity: 5.9 (Moderate).
The vendor was contacted beforehand, confirmed the issue and published advisory GHSA-hq22-f7w6-p8cr. Upgrading to version 2026.09.29 addresses this issue. No CVE has been assigned.
Product: https://github.com/alexta69/metube |
|---|
| 원천 | ⚠️ https://github.com/alexta69/metube/security/advisories/GHSA-hq22-f7w6-p8cr |
|---|
| 사용자 | lijunjie (UID 101496) |
|---|
| 제출 | 2026. 10. 01. PM 12:46 (18 날 ago) |
|---|
| 모더레이션 | 2026. 10. 18. PM 03:50 (17 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 421755 [alexta69 MeTube 까지 2026.09.28 Feed-metadata Thumbnail Fetch app/ytdl.py DownloadQueue.__write_feed_metadata_sync 권한 상승] |
|---|
| 포인트들 | 20 |
|---|