PT-2023-29854 · Yt-Dlp+2 · Yt-Dlp+2

Coletdjnz · Published 2023-11-14 · Updated 2025-01-28 · CVE-2023-46121

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions yt-dlp versions prior to 2023.11.14

Description The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary URL, allowing the attacker to perform a Man-In-The-Middle (MITM) attack on the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases. The issue arises from the ability to smuggle HTTP headers, including proxy settings, to the Generic extractor through a URL. An attacker can exploit this to set an arbitrary proxy for an arbitrary URL that the Generic extractor will request, potentially allowing them to intercept cookies not marked as secure.

Recommendations For versions prior to 2023.11.14, upgrade to version 2023.11.14 or later to remove the ability to smuggle HTTP headers to the Generic extractor. As a temporary workaround, consider disabling the Generic extractor by using the --ies default,-generic option, or only pass trusted sites with trusted content to minimize the risk of exploitation. Take caution when using the --no-check-certificate option to avoid increasing the vulnerability to MITM attacks.

Exploit

Fix

Insufficient Session Expiration

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-613

CWE-444

Related Identifiers

ALT-PU-2023-8431

ALT-PU-2024-13204

CVE-2023-46121

GHSA-3CH3-JHC6-5R8X

OPENSUSE-SU-2023:0374-1

OPENSUSE-SU-2024:13435-1

ROSA-SA-2025-2614

Affected Products

Alt Linux

Debian

Yt-Dlp

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46121.json · Exploit
• https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-3ch3-jhc6-5r8x · Vendor Advisory
• https://github.com/yt-dlp/yt-dlp/commit/f04b5bedad7b281bee9814686bba1762bae092eb · Patch
• https://osv.dev/vulnerability/CVE-2023-46121 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46121 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46121 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3ch3-jhc6-5r8x · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-46121 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13435-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-46121 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2023:0374-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-46121 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46121 · Vendor Advisory
• https://github.com/yt-dlp/yt-dlp · Note
• https://github.com/yt-dlp/yt-dlp/releases/tag/2023.11.14 · Note