PT-2022-13424 · Alltube+1 · Alltube+1

Published 2022-02-28 · Updated 2022-03-08 · CVE-2022-0768

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions alltube versions prior to 3.0.2

Description The issue allows an attacker to send a request to an internal hostname, exploiting a Server-Side Request Forgery vulnerability. This vulnerability affects releases prior to version 3.0.2.

Recommendations For versions prior to 3.0.2, update to version 3.0.2 to resolve the issue. Additionally, if using an external version of youtube-dl, apply the patch to youtube-dl to prevent it from following HTTP redirects, as the bundled version with 3.0.2 is already patched.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-0768

GHSA-R5HC-WM3G-HJW6

Affected Products

Alltube

Youtube-Dl

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0768.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/rudloff/alltube/CVE-2022-0768.yaml · Exploit
• 🔥 https://huntr.dev/bounties/9b14cc46-ec08-4940-83cc-9f986b2a5903 · Exploit
• https://github.com/rudloff/alltube/commit/148a171b240e7ceb076b9e198bef412de14ac55d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0768 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0768 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r5hc-wm3g-hjw6 · Vendor Advisory
• https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d · Note
• https://github.com/Rudloff/alltube/security/advisories/GHSA-r5hc-wm3g-hjw6 · Note
• https://github.com/Rudloff/alltube · Note