Impact
- Arbitrary read and write across every table the peertube DB role can reach
- Stealth account takeover via reading plain-text OAuth access tokens from
oAuthToken.accessToken; tokens survive password resets
- Administrator takeover by overwriting the bcrypt hash for the built-in root user (universal
user.id=1, hard-coded in installer.ts) — proven end-to-end with a working OAuth login
- Post-takeover RCE inside the PeerTube Node.js process via the documented plugin install path (
require(modulePath) in plugin-manager.ts)
- Database-host RCE in the official Docker compose layout, because
POSTGRES_USER=peertube creates the role as cluster superuser; COPY ... FROM PROGRAM is then reachable. The from-source install documented at support/doc/production.md does not give the role superuser, so this tier is configuration-dependent
Patches
Patched Versions: 8.1.6
Workarounds
See workarounds in v8.1.8 changelog.
f3nrir77 Reporter
Impact
oAuthToken.accessToken; tokens survive password resetsuser.id=1, hard-coded in installer.ts) — proven end-to-end with a working OAuth loginrequire(modulePath)inplugin-manager.ts)POSTGRES_USER=peertubecreates the role as cluster superuser; COPY ... FROM PROGRAM is then reachable. The from-source install documented at support/doc/production.md does not give the role superuser, so this tier is configuration-dependentPatches
Patched Versions: 8.1.6
Workarounds
See workarounds in v8.1.8 changelog.