CVE-2024-22423
📋 TL;DR
This vulnerability in yt-dlp allows remote code execution when using the --exec option with output template expansion. Attackers can exploit insufficient escaping of environment variables to execute arbitrary commands on affected systems. Users who run yt-dlp with --exec and output template expansion are affected.
💻 Affected Systems
- yt-dlp
📦 What is this software?
Yt Dlp by Yt Dlp Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the affected system, allowing data theft, ransomware deployment, or lateral movement.
Likely Case
Arbitrary command execution with the privileges of the user running yt-dlp, potentially leading to data exfiltration, cryptocurrency mining, or botnet enrollment.
If Mitigated
No impact if proper patching is applied or if --exec with template expansion is avoided.
🎯 Exploit Status
Exploitation requires tricking users into running yt-dlp with malicious --exec parameters. The vulnerability is in command parsing logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.04.09
Vendor Advisory: https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-42h4-v29r-42qg
Restart Required: No
Instructions:
1. Upgrade yt-dlp to version 2024.04.09 or later. 2. On Linux/macOS: pip install --upgrade yt-dlp. 3. On Windows: yt-dlp --update or download from GitHub releases.
🔧 Temporary Workarounds
Avoid template expansion in --exec
allOnly use {} (filepath) in --exec arguments, avoid other template expansions like %(title)s
# Use only: yt-dlp --exec 'command {}'
# Avoid: yt-dlp --exec 'command %(title)s'
Use info json instead of --exec
allWrite metadata to JSON file and process separately instead of using --exec
yt-dlp --write-info-json
# Then process the JSON file with a separate script
🧯 If You Can't Patch
- Avoid using --exec with any output template expansion other than {}
- Validate all fields used in --exec to ensure they don't contain ", |, or & characters
🔍 How to Verify
Check if Vulnerable:
Check yt-dlp version: if between 2021.04.11 and 2024.04.08 and you use --exec with template expansion, you are vulnerable.Check Version:
yt-dlp --versionVerify Fix Applied:
Verify yt-dlp version is 2024.04.09 or later using yt-dlp --version📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns from yt-dlp processes
- Suspicious --exec arguments in command line logs
Network Indicators:
- Unexpected outbound connections from yt-dlp execution
- Downloads from unusual sources
SIEM Query:
process_name:"yt-dlp" AND cmdline:"--exec" AND NOT cmdline:"\{\}"🔗 References
- https://github.com/yt-dlp/yt-dlp/commit/de015e930747165dbb8fcd360f8775fd973b7d6e
- https://github.com/yt-dlp/yt-dlp/commit/ff07792676f404ffff6ee61b5638c9dc1a33a37a
- https://github.com/yt-dlp/yt-dlp/releases/tag/2021.04.11
- https://github.com/yt-dlp/yt-dlp/releases/tag/2024.04.09
- https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-42h4-v29r-42qg
- https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-hjq6-52gw-2g7p
- https://www.kb.cert.org/vuls/id/123335
- https://github.com/yt-dlp/yt-dlp/commit/de015e930747165dbb8fcd360f8775fd973b7d6e
- https://github.com/yt-dlp/yt-dlp/commit/ff07792676f404ffff6ee61b5638c9dc1a33a37a
- https://github.com/yt-dlp/yt-dlp/releases/tag/2021.04.11
- https://github.com/yt-dlp/yt-dlp/releases/tag/2024.04.09
- https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-42h4-v29r-42qg
- https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-hjq6-52gw-2g7p
- https://www.kb.cert.org/vuls/id/123335
