PT-2020-17350 · Tindy2013 · Subconverter

Imlk0O · Published 2020-12-20 · Updated 2020-12-22 · CVE-2020-35579

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions tindy2013 subconverter version 0.6.4

Description The issue concerns a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and launches a GET request for it. However, it does not account for the possibility that the external request target may indirectly redirect back to this original /sub endpoint, potentially leading to a request loop and a denial of service.

Recommendations For version 0.6.4, consider disabling the /sub API endpoint until a patch is available to prevent potential denial of service attacks. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the url parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2020-35579

Affected Products

Subconverter

References · 6

• 🔥 https://github.com/tindy2013/subconverter/issues/284 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-35579 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35579 · Vendor Advisory
• https://t.me/cvenotify/7576 · Telegram Post
• https://t.me/cvenotify/7438 · Telegram Post
• https://t.me/cvenotify/7423 · Telegram Post