CVE-2022-24739: Rudloff/alltube Server-Side Request Forgery And Open Vulnerability
HIGHCVE-2022-24739 is a HIGH (CVSS 7.3) server-side request forgery and open vulnerability (CWE-601: URL Redirection to Untrusted Site ('Open Redirect')) affecting Rudloff/alltube libraries in the Packagist ecosystem. The issue involves server-side request forgery and open redirect in alltube download. Remediation is available by upgrading affected packages to version 3.0.3.
CVE-2022-24739 at a Glance
Security Impact
CVSS: 7.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
How to Fix CVE-2022-24739
To remediate this vulnerability, upgrade all affected Rudloff/alltube dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade rudloff/alltube to 3.0.3Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for rudloff/alltubeHow to Check if You Are Affected
To determine whether your application is affected by CVE-2022-24739, inspect your project dependencies for Rudloff/alltube:
inspect dependencies for rudloff/alltubeAnalyze the terminal output to locate any version of Rudloff/alltube in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.0.3), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-601: URL Redirection to Untrusted Site ('Open Redirect'), where the web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. In Rudloff/alltube, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2022-24739 Affected Rudloff/alltube Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
rudloff/alltube
|
Packagist |
< 3.0.3
|
3.0.3
|
References
Frequently Asked Questions
What is CVE-2022-24739?
Which Rudloff/alltube versions are affected?
What version fixes CVE-2022-24739?
Is rudloff/alltube affected?
What is the CVSS score of CVE-2022-24739?
What CWE is associated with CVE-2022-24739?
How can I check Packagist dependencies for CVE-2022-24739?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-75p7-527p-w8wp",
"modified" : "2022-03-09T20:13:46Z",
"published" : "2022-03-09T15:17:31Z",
"aliases" : [ "CVE-2022-24739" ],
"summary" : "Server-Side Request Forgery and Open Redirect in AllTube Download",
"details" : "### Impact\n\nOn releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured).\n\nThe impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.)\n\n### Patches\n\n3.0.3 contains a fix for this vulnerability.\n(The 1.x and 2.x releases are not maintained anymore.)\n\nThe fix requires applying [a patch](https://github.com/Rudloff/alltube/blob/3d092891044f2685ed66c73c870a021bee319c37/patches/youtube-dl-disable-generic.diff) to youtube-dl to disable its generic extractor. If you are using the version of youtube-dl bundled with 3.0.3, it is already patched.\nHowever, if you are using your own unpatched version of youtube-dl **you might still be vulnerable**.\n\n### References\n\n* https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a\n* https://github.com/ytdl-org/youtube-dl/issues/30691\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "rudloff/alltube"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "3.0.3"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/Rudloff/alltube/security/advisories/GHSA-75p7-527p-w8wp"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-24739"
}, {
"type" : "WEB",
"url" : "https://github.com/ytdl-org/youtube-dl/issues/30691"
}, {
"type" : "WEB",
"url" : "https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d"
}, {
"type" : "WEB",
"url" : "https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a"
}, {
"type" : "WEB",
"url" : "https://github.com/Rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a"
}, {
"type" : "WEB",
"url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/rudloff/alltube/CVE-2022-24739.yaml"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/Rudloff/alltube"
}, {
"type" : "WEB",
"url" : "https://github.com/Rudloff/alltube/releases/tag/3.0.3"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-601", "CWE-918" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2022-03-09T15:17:31Z",
"nvd_published_at" : "2022-03-08T22:15:00Z"
}
}