External Control of File Name or Path in streamlink - #VU153943

Vulnerability details

The vulnerability allows a remote attacker to read arbitrary local files accessible to the Streamlink process.

The vulnerability exists due to missing URL scheme validation in the DASH manifest parser's top-level <Location> handling when processing attacker-controlled manifests. A remote attacker can trick a user into opening an attacker-controlled URL serving a manifest with a crafted <Location> element containing a file:// URL to read arbitrary local files accessible to the Streamlink process.

The manifest reload path requires a dynamic manifest, whereas the segment path is available for both static and dynamic manifests. The segment path writes file contents to the user's configured stream output destination.

Affected software

Remediation

External References

• https://github.com/streamlink/streamlink/security/advisories/GHSA-j7pf-m7gx-jr33
• https://github.com/streamlink/streamlink/releases/tag/8.6.2

Related Security Bulletins

• Path traversal in streamlink