| 제목 | welovemedia FFmate <= v2.0.15 Argument Injection |
|---|
| 설명 | An argument injection vulnerability exists in FFmate ≤ v2.0.15 at the FFmpeg command execution functionality, where user-controlled command parameters are passed directly to the FFmpeg binary without sufficient validation or sanitization. While the application attempts to prevent command injection through shell escaping, attackers can still manipulate FFmpeg's extensive argument options to perform unintended operations. Specifically, by crafting malicious preset commands that leverage FFmpeg's metadata writing capabilities, attackers can construct text files with arbitrary content and write them to arbitrary filesystem locations accessible to the application process. This enables attackers to overwrite critical system files, inject SSH authorized keys for remote access, modify application configuration files, and potentially achieve full remote code execution. Mitigations include implementing strict allowlists for permitted FFmpeg arguments and output formats, validating and restricting output file paths to designated safe directories, removing dangerous FFmpeg capabilities such as arbitrary metadata file writing, and conducting thorough input validation on all user-supplied preset commands. |
|---|
| 원천 | ⚠️ https://github.com/CC-T-454455/Vulnerabilities/tree/master/ffmate/vulnerability-3 |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2026. 02. 22. PM 04:49 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 03. 06. PM 10:29 (12 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 349584 [welovemedia FFmate 까지 2.0.15 ffmpeg.go Execute 권한 상승] |
|---|
| 포인트들 | 20 |
|---|