PT-2022-16841 · Alltube+1 · Alltube+1

Rudloff · Published 2022-03-08 · Updated 2022-03-14 · CVE-2022-24739

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions AllTube versions prior to 3.0.3

Description AllTube is an HTML front end for youtube-dl. An attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack, depending on how AllTube is configured. The impact is mitigated by the fact that the SSRF attack is only possible when the stream option is enabled in the configuration, which is disabled by default.

Recommendations For versions prior to 3.0.3, update to version 3.0.3 to fix the vulnerability. Additionally, if using a custom version of youtube-dl, apply the patch to disable its generic extractor to prevent potential vulnerability. If the stream option is enabled, consider disabling it until the issue is resolved.

Exploit

Fix

Open Redirect

SSRF

Weakness Enumeration

CWE-601

CWE-918

Related Identifiers

CVE-2022-24739

GHSA-75P7-527P-W8WP

Affected Products

Alltube

Youtube-Dl

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24739.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/rudloff/alltube/CVE-2022-24739.yaml · Exploit
• https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a · Patch
• https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d · Patch
• https://github.com/Rudloff/alltube/security/advisories/GHSA-75p7-527p-w8wp · Patch
• https://github.com/Rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24739 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24739 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-75p7-527p-w8wp · Vendor Advisory
• https://github.com/ytdl-org/youtube-dl/issues/30691 · Note
• https://github.com/Rudloff/alltube/releases/tag/3.0.3 · Note
• https://github.com/Rudloff/alltube · Note
• https://t.me/cibsecurity/38562 · Telegram Post
• https://t.me/cvenotify/27942 · Telegram Post