| 제목 | marcopiovanello yt-dlp-web-ui 4 Command Injection |
|---|
| 설명 | A default deployment (no config.yml → require_auth=false, bound to x.x.x.x:3033) allows unauthenticated remote code execution as root via the params array of POST /api/v1/exec.
1. main.go sets authentication.require_auth default to false; auth middleware in server/rest/container.go / server/rpc/container.go is skipped unless enabled.
2. User-supplied params reach yt-dlp nearly verbatim (server/internal/downloaders/generic.go, argsSanitizer in server/internal/downloaders/utils.go only strips ${ and &&).
3. --no-exec is placed before user params, so it doesn't help: it only clears --exec (store_const, dest='exec_cmd'), it never touches --exec-before-download (dest='exec_before_dl_cmd, merged into exec_cmd['before_dl'] in yt-dlp's __init__.py), and a later --exec overrides it (last-wins).
PoC (single unauthenticated request, runs as root in the container):
curl -X POST http://target:3033/api/v1/exec -H 'Content-Type: application/json' \
-d '{"url":"https://www.youtube.com/watch?v=dQw4w9WgXcQ",
"params":["--exec-before-download","id > /downloads/pwned.txt; exit 0; "]}'
|
|---|
| 원천 | ⚠️ https://github.com/marcopiovanello/yt-dlp-web-ui/commit/c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 |
|---|
| 사용자 | HLever (UID 100450) |
|---|
| 제출 | 2026. 08. 22. AM 12:00 (28 날 ago) |
|---|
| 모더레이션 | 2026. 09. 17. PM 09:28 (27 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 406851 [marcopiovanello yt-dlp-web-ui 까지 v4 generic.go NewGenericDownload params 권한 상승] |
|---|
| 포인트들 | 20 |
|---|