CVE-2022-24739
📋 TL;DR
CVE-2022-24739 is a vulnerability in AllTube (an HTML frontend for youtube-dl) that allows attackers to craft malicious HTML pages to trigger either open redirect attacks or Server-Side Request Forgery (SSRF) attacks. The SSRF attack is only possible when the 'stream' configuration option is enabled, which is disabled by default. Users running AllTube versions prior to 3.0.3 are affected.
💻 Affected Systems
- AllTube
📦 What is this software?
Alltube by Alltube Project
⚠️ Risk & Real-World Impact
Worst Case
If the 'stream' option is enabled, attackers could perform SSRF attacks to access internal services, potentially leading to data exfiltration, internal network reconnaissance, or chaining with other vulnerabilities.
Likely Case
Open redirect attacks where users are tricked into visiting malicious sites through legitimate-looking AllTube URLs.
If Mitigated
Only open redirect attacks are possible when 'stream' option is disabled (default configuration).
🎯 Exploit Status
Exploitation requires crafting malicious HTML pages. GitHub advisory includes technical details and proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.3
Vendor Advisory: https://github.com/Rudloff/alltube/security/advisories/GHSA-75p7-527p-w8wp
Restart Required: Yes
Instructions:
1. Update AllTube to version 3.0.3 or later. 2. Restart the AllTube service. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Disable stream option
allEnsure the 'stream' configuration option is disabled to prevent SSRF attacks
Edit config.php and set 'stream' => false
Input validation
allImplement URL validation for user-supplied URLs
🧯 If You Can't Patch
- Ensure 'stream' configuration option is disabled (default setting)
- Implement web application firewall rules to detect and block SSRF and open redirect attempts
🔍 How to Verify
Check if Vulnerable:
Check AllTube version and configuration. If version < 3.0.3, system is vulnerable to open redirect. If 'stream' option is enabled, also vulnerable to SSRF.Check Version:
Check version in AllTube web interface or config filesVerify Fix Applied:
Verify AllTube version is 3.0.3 or later. Test that crafted URLs with redirect parameters no longer work.📡 Detection & Monitoring
Log Indicators:
- Unusual redirect patterns in access logs
- Requests to internal IP addresses from AllTube
Network Indicators:
- Outbound connections from AllTube to unexpected internal services
- Redirects to external domains from AllTube URLs
SIEM Query:
source="alltube" AND (url="*redirect=*" OR url="*url=*")🔗 References
- https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d
- https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a
- https://github.com/Rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a
- https://github.com/Rudloff/alltube/security/advisories/GHSA-75p7-527p-w8wp
- https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d
- https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a
- https://github.com/Rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a
- https://github.com/Rudloff/alltube/security/advisories/GHSA-75p7-527p-w8wp
