yt-dlp 2023.09.24.003044/2023.7.06/2023.11.14 Working Directory unrestricted upload

Summaryinfo

A vulnerability marked as critical has been reported in yt-dlp. This affects an unknown part of the component Working Directory Handler. The manipulation leads to unrestricted upload. This vulnerability is traded as CVE-2024-38519. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in yt-dlp and classified as critical. This issue affects an unknown code of the component Working Directory Handler. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

`yt-dlp` is a command-line audio/video downloader. Prior to version 2024.07.01, `yt-dlp` does not limit the extensions of downloaded files, which could lead to aribitrary filenames being created in the download folder (and path traversal on Windows). Since `yt-dlp` also reads config from the working directory (and on Windows executables will be executed from the yt-dlp directory) this could lead to arbitrary code being executed. `yt-dlp` version 2024.07.01 fixes this issue by whitelisting the allowed extensions. This might mean some very uncommon extensions might not get downloaded, however it will also limit the possible exploitation surface. In addition to upgrading, have `.%(ext)s` at the end of the output template and make sure the user trusts the websites that they are downloading from. Also, make sure to never download to a directory within PATH or other sensitive locations like one's user directory, `system32`, or other binaries locations. For users who are not able to upgrade, keep the default output template (`-o "%(title)s [%(id)s].%(ext)s`); make sure the extension of the media to download is a common video/audio/sub/... one; try to avoid the generic extractor; and/or use `--ignore-config --config-location ...` to not load config from common locations.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2024-38519 since 06/18/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 239934 (TencentOS Server 4: youtube-dl (TSSA-2025:0179)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2024.07.01 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5ce582448ececb8d9c30c8c31f58330090ced03a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (239934). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Data Loss Prevention Software

Name

• yt-dlp

Version

• 2023.09.24.003044
• 2023.7.06
• 2023.11.14

License

• open-source

Website

• Product: https://github.com/yt-dlp/yt-dlp/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion