Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency yt-dlp to v2024 [SECURITY] - autoclosed #100

Closed
wants to merge 1 commit into from
Closed

Update dependency yt-dlp to v2024 [SECURITY] - autoclosed #100

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented May 1, 2024

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
yt-dlp ==2023.7.6 -> ==2024.4.9 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-22423

Summary

The patch that addressed CVE-2023-40581 attempted to prevent RCE when using --exec with %q by replacing double quotes with two double quotes.
However, this escaping is not sufficient, and still allows expansion of environment variables.

Support for output template expansion in --exec, along with this vulnerable behavior, was added to yt-dlp in version 2021.04.11.

> yt-dlp "https://youtu.be/42xO6rVqf2E" --ignore-config -f 18 --exec "echo %(title)q"
[youtube] Extracting URL: https://youtu.be/42xO6rVqf2E
[youtube] 42xO6rVqf2E: Downloading webpage
[youtube] 42xO6rVqf2E: Downloading ios player API JSON
[youtube] 42xO6rVqf2E: Downloading android player API JSON
[youtube] 42xO6rVqf2E: Downloading m3u8 information
[info] 42xO6rVqf2E: Downloading 1 format(s): 18
[download] Destination: %CMDCMDLINE：~-1%&echo pwned&calc.exe [42xO6rVqf2E].mp4
[download] 100% of  126.16KiB in 00:00:00 at 2.46MiB/s
[Exec] Executing command: echo "%CMDCMDLINE:~-1%&echo pwned&calc.exe"
""
pwned

Patches

yt-dlp version 2024.04.09 fixes this issue by properly escaping %. It replaces them with %%cd:~,%, a variable that expands to nothing, leaving only the leading percent.

Workarounds

It is recommended to upgrade yt-dlp to version 2024.04.09 as soon as possible. Also, always be careful when using --exec, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous.

For Windows users who are not able to upgrade:

  • Avoid using any output template expansion in --exec other than {} (filepath).
  • If expansion in --exec is needed, verify the fields you are using do not contain %, ", | or &.
  • Instead of using --exec, write the info json and load the fields from it instead.

Details

When escaping variables, the following code is used for Windows.
yt_dlp/compat/__init__.py line 31-33

    def compat_shlex_quote(s):
        import re
        return s if re.match(r'^[-_\w./]+$', s) else s.replace('"', '""').join('""')

It replaces " with "" to balance out the quotes and keep quoting intact if non-allowed characters are included. However, the %CMDCMDLINE% variable can be used to generate a quote using %CMDCMDLINE:~-1%; since the value of %CMDCMDLINE% is the commandline with which cmd.exe was called, and it is always called with the command surrounded by quotes, %CMDCMDLINE:~-1% expands to ". After the quotes have been unbalanced, special characters are no longer quoted and commands can be executed:

%CMDCMDLINE:~-1%&calc.exe

References

Release Notes

yt-dlp/yt-dlp (yt-dlp)

v2024.4.9

Compare Source

v2024.3.10

Compare Source

v2023.12.30

Compare Source

Core changes
Extractor changes
Postprocessor changes
Networking changes
Misc. changes

v2023.11.16

Compare Source

Extractor changes
Misc. changes

v2023.11.14

Compare Source

Important changes
Core changes
Extractor changes
Downloader changes
Networking changes
Misc. changes

v2023.10.13

Compare Source

Core changes
Extractor changes
Downloader changes
Misc. changes

v2023.10.7

Compare Source

v2023.9.24

Compare Source

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@github-actions GitHub Actions
Copy link

github-actions bot commented May 1, 2024 •
edited
Loading

🦙 MegaLinter status: ❌ ERROR

Descriptor Linter Files Fixed Errors Elapsed time
❌ ACTION actionlint 20 47 0.6s
❌ COPYPASTE jscpd yes 1258 52.01s
❌ CSS stylelint 19 14 1 3.84s
❌ DOCKERFILE hadolint 1 1 0.26s
✅ ENV dotenv-linter 1 1 0 0.03s
❌ HTML djlint 7 56 1668.7s
❌ HTML htmlhint 7 55 0.41s
❌ JAVASCRIPT standard 30 30 1 6.86s
❌ JSON jsonlint 356 1 0.42s
✅ JSON prettier 356 318 0 58.63s
❌ JSON v8r 356 1 1.02s
⚠️ MARKDOWN markdownlint 2414 179 3912 44.35s
❌ MARKDOWN markdown-link-check 2414 59 6.62s
✅ MARKDOWN markdown-table-formatter 2414 1526 0 10.47s
❌ REPOSITORY checkov yes 70 464.2s
❌ REPOSITORY gitleaks yes 422 4265.39s
✅ REPOSITORY git_diff yes no 14.52s
❌ REPOSITORY grype yes 1 25.17s
❌ REPOSITORY secretlint yes 1 758.1s
❌ REPOSITORY trivy yes 1 97.42s
✅ REPOSITORY trivy-sbom yes no 3.04s
✅ REPOSITORY trufflehog yes no 82.89s
❌ SPELL cspell 6998 190818 6211.53s
❌ SPELL lychee 5759 1 3.99s
❌ TYPESCRIPT ts-standard 7 0 1 0.68s
✅ YAML prettier 1215 1200 0 217.48s
❌ YAML v8r 1215 1 1.3s
❌ YAML yamllint 1215 1 867.3s

See detailed report in MegaLinter reports

MegaLinter is graciously provided by OX Security

@renovate renovate bot changed the title Update dependency yt-dlp to v2024 [SECURITY] Update dependency yt-dlp to v2024 [SECURITY] - autoclosed May 2, 2024
@renovate renovate bot closed this May 2, 2024
@renovate renovate bot deleted the renovate/pypi-yt-dlp-vulnerability branch May 2, 2024 05:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
0 participants