CVE-2022-24739: Server-Side Request Forgery (SSRF) (CWE-918)
value: alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 6.1
Published: 2022-03-08T22:15Z
Repository: https://github.com/Rudloff/alltube
Language: JSON
Files changed: composer.json, composer.lock, patches/youtube-dl-disable-generic.diff
Commit date: 2022-03-08 09:29:57 +0100
Commit message: Disable the generic extractor entirely
It can be used for SSRF attacks even when redirects are disabled

Diff: diff --git a/composer.json b/composer.json
index c02f102..21640dd 100644
--- a/composer.json
+++ b/composer.json
@@ -76,11 +76,11 @@
     "installer-types": [
       "library"
     ],
     "patches": {
       "ytdl-org/youtube-dl": {
-        "Disable redirects in generic extractor": "patches/youtube-dl-redirect.diff"
+        "Disable the generic extractor": "patches/youtube-dl-disable-generic.diff"
       }
     }
   },
   "autoload": {
     "psr-4": {
diff --git a/composer.lock b/composer.lock
index 676e600..4a788ef 100644
--- a/composer.lock
+++ b/composer.lock
@@ -2,11 +2,11 @@
     "_readme": [
         "This file locks the dependencies of your project to a known state",
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "b5c12c24e723e5246b8003cd84de873f",
+    "content-hash": "87b2074ab1d8a7ee59f719e26130ca36",
     "packages": [
         {
             "name": "aura/session",
             "version": "2.1.0",
             "source": {
@@ -4084,16 +4084,16 @@
                 "amphp/php-cs-fixer-config": "dev-master",
                 "phpunit/phpunit": "^9 || ^8 || ^7"
             },
             "type": "library",
             "autoload": {
-                "psr-4": {
-                    "Amp\\Serialization\\": "src"
-                },
                 "files": [
                     "src/functions.php"
-                ]
+                ],
+                "psr-4": {
+                    "Amp\\Serialization\\": "src"
+                }
             },
             "notification-url": "https://packagist.org/downloads/",
             "license": [
                 "MIT"
             ],
diff --git a/patches/youtube-dl-disable-generic.diff b/patches/youtube-dl-disable-generic.diff
new file mode 100644
index 0000000..f02f6d4
--- /dev/null
+++ b/patches/youtube-dl-disable-generic.diff
@@ -0,0 +1,12 @@
+diff --git a/youtube_dl/extractor/__init__.py b/youtube_dl/extractor/__init__.py
+index 18d8dbcd6..4d3edfac3 100644
+--- a/youtube_dl/extractor/__init__.py
++++ b/youtube_dl/extractor/__init__.py
+@@ -13,7 +13,6 @@ except ImportError:
+         for name, klass in globals().items()
+         if name.endswith('IE') and name != 'GenericIE'
+     ]
+-    _ALL_CLASSES.append(GenericIE)
+ 
+ 
+ def gen_extractor_classes():
diff --git a/patches/youtube-dl-redirect.diff b/patches/youtube-dl-redirect.diff
deleted file mode 100644
index d3f5530..0000000
--- a/patches/youtube-dl-redirect.diff
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/youtube_dl/extractor/generic.py b/youtube_dl/extractor/generic.py
-index f99d887ca..749ed6ecf 100644
---- a/youtube_dl/extractor/generic.py
-+++ b/youtube_dl/extractor/generic.py
-@@ -2252,6 +2252,7 @@ class GenericIE(InfoExtractor):
- 
-     def report_following_redirect(self, new_url):
-         """Report information extraction."""
-+        raise UnsupportedError('Redirects are not allowed')
-         self._downloader.to_screen('[redirect] Following redirect to %s' % new_url)
- 
-     def _extract_rss(self, url, video_id, doc):

Vulnerable code:         "Disable redirects in generic extractor": "patches/youtube-dl-redirect.diff"
    "content-hash": "b5c12c24e723e5246b8003cd84de873f",
                "psr-4": {
                    "Amp\\Serialization\\": "src"
                },
                ]
diff --git a/youtube_dl/extractor/generic.py b/youtube_dl/extractor/generic.py
index f99d887ca..749ed6ecf 100644
+++ b/youtube_dl/extractor/generic.py
@@ -2252,6 +2252,7 @@ class GenericIE(InfoExtractor):
 
     def report_following_redirect(self, new_url):
         """Report information extraction."""
+        raise UnsupportedError('Redirects are not allowed')
         self._downloader.to_screen('[redirect] Following redirect to %s' % new_url)
 
     def _extract_rss(self, url, video_id, doc):
Fixed code:         "Disable the generic extractor": "patches/youtube-dl-disable-generic.diff"
    "content-hash": "87b2074ab1d8a7ee59f719e26130ca36",
                ],
                "psr-4": {
                    "Amp\\Serialization\\": "src"
                }
diff --git a/youtube_dl/extractor/__init__.py b/youtube_dl/extractor/__init__.py
index 18d8dbcd6..4d3edfac3 100644
--- a/youtube_dl/extractor/__init__.py
@@ -13,7 +13,6 @@ except ImportError:
         for name, klass in globals().items()
         if name.endswith('IE') and name != 'GenericIE'
     ]
-    _ALL_CLASSES.append(GenericIE)
 
 
 def gen_extractor_classes():