GHSA-22fp-mf44-f2mq: youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization
7.8
Basic Information
PythonTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| youtube-dl | pip | >= 2015.01.25, <= 2021.12.17 | 2024-07-03 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability described is due to improper file-extension sanitization, allowing path traversal and arbitrary file creation. The provided commit d42a222ed541b96649396ef00e19552aef0f09ec directly addresses this by overhauling the extension handling logic.
The analysis of the patch in youtube_dl/utils.py shows that the functions prepend_extension and replace_extension were completely rewritten. Their previous implementations (visible as removed lines in the diff) directly concatenated or formatted the filename and extension strings without any sanitization of the ext parameter. This lack of sanitization is the core of the vulnerability, as it allowed malicious strings to be passed via the ext parameter, leading to the described security issues.
The new implementations delegate the logic to a new internal function _change_extension, which in turn uses _UnsafeExtensionError.sanitize_extension. This new sanitize_extension method explicitly checks for path traversal characters ('/' and '\') and validates the extension against a whitelist of allowed extensions, throwing an _UnsafeExtensionError if the checks fail.
The functions YoutubeDL.process_info in youtube_dl/YoutubeDL.py was modified by adding the @_catch_unsafe_file_extension decorator. This indicates that process_info is a higher-level function that likely invokes (directly or indirectly) the extension manipulation functions and is now equipped to handle the errors from the new sanitization logic. However, the vulnerability itself (the lack of sanitization) was located within the prepend_extension and replace_extension functions as they existed before this patch.
Therefore, the identified vulnerable functions are the pre-patch versions of youtube_dl.utils.prepend_extension and youtube_dl.utils.replace_extension because they processed potentially malicious input (the extension string) without adequate sanitization, directly leading to the vulnerability.