CVE-2022-24739: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2022-03-08T22:15Z
Repository: https://github.com/Rudloff/alltube
Language: JSON
Files changed: composer.json, composer.lock, patches/youtube-dl-disable-generic.diff
Commit date: 2022-03-08 09:29:57 +0100
Commit message: Disable the generic extractor entirely
It can be used for SSRF attacks even when redirects are disabled

Diff: diff --git a/composer.json b/composer.json
index c02f102..21640dd 100644
--- a/composer.json
+++ b/composer.json
@@ -76,11 +76,11 @@
     "installer-types": [
       "library"
     ],
     "patches": {
       "ytdl-org/youtube-dl": {
-        "Disable redirects in generic extractor": "patches/youtube-dl-redirect.diff"
+        "Disable the generic extractor": "patches/youtube-dl-disable-generic.diff"
       }
     }
   },
   "autoload": {
     "psr-4": {
diff --git a/composer.lock b/composer.lock
index 676e600..4a788ef 100644
--- a/composer.lock
+++ b/composer.lock
@@ -2,11 +2,11 @@
     "_readme": [
         "This file locks the dependencies of your project to a known state",
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "b5c12c24e723e5246b8003cd84de873f",
+    "content-hash": "87b2074ab1d8a7ee59f719e26130ca36",
     "packages": [
         {
             "name": "aura/session",
             "version": "2.1.0",
             "source": {
@@ -4084,16 +4084,16 @@
                 "amphp/php-cs-fixer-config": "dev-master",
                 "phpunit/phpunit": "^9 || ^8 || ^7"
             },
             "type": "library",
             "autoload": {
-                "psr-4": {
-                    "Amp\\Serialization\\": "src"
-                },
                 "files": [
                     "src/functions.php"
-                ]
+                ],
+                "psr-4": {
+                    "Amp\\Serialization\\": "src"
+                }
             },
             "notification-url": "https://packagist.org/downloads/",
             "license": [
                 "MIT"
             ],
diff --git a/patches/youtube-dl-disable-generic.diff b/patches/youtube-dl-disable-generic.diff
new file mode 100644
index 0000000..f02f6d4
--- /dev/null
+++ b/patches/youtube-dl-disable-generic.diff
@@ -0,0 +1,12 @@
+diff --git a/youtube_dl/extractor/__init__.py b/youtube_dl/extractor/__init__.py
+index 18d8dbcd6..4d3edfac3 100644
+--- a/youtube_dl/extractor/__init__.py
++++ b/youtube_dl/extractor/__init__.py
+@@ -13,7 +13,6 @@ except ImportError:
+         for name, klass in globals().items()
+         if name.endswith('IE') and name != 'GenericIE'
+     ]
+-    _ALL_CLASSES.append(GenericIE)
+ 
+ 
+ def gen_extractor_classes():
diff --git a/patches/youtube-dl-redirect.diff b/patches/youtube-dl-redirect.diff
deleted file mode 100644
index d3f5530..0000000
--- a/patches/youtube-dl-redirect.diff
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/youtube_dl/extractor/generic.py b/youtube_dl/extractor/generic.py
-index f99d887ca..749ed6ecf 100644
---- a/youtube_dl/extractor/generic.py
-+++ b/youtube_dl/extractor/generic.py
-@@ -2252,6 +2252,7 @@ class GenericIE(InfoExtractor):
- 
-     def report_following_redirect(self, new_url):
-         """Report information extraction."""
-+        raise UnsupportedError('Redirects are not allowed')
-         self._downloader.to_screen('[redirect] Following redirect to %s' % new_url)
- 
-     def _extract_rss(self, url, video_id, doc):

Vulnerable code:         "Disable redirects in generic extractor": "patches/youtube-dl-redirect.diff"
    "content-hash": "b5c12c24e723e5246b8003cd84de873f",
                "psr-4": {
                    "Amp\\Serialization\\": "src"
                },
                ]
diff --git a/youtube_dl/extractor/generic.py b/youtube_dl/extractor/generic.py
index f99d887ca..749ed6ecf 100644
+++ b/youtube_dl/extractor/generic.py
@@ -2252,6 +2252,7 @@ class GenericIE(InfoExtractor):
 
     def report_following_redirect(self, new_url):
         """Report information extraction."""
+        raise UnsupportedError('Redirects are not allowed')
         self._downloader.to_screen('[redirect] Following redirect to %s' % new_url)
 
     def _extract_rss(self, url, video_id, doc):
Fixed code:         "Disable the generic extractor": "patches/youtube-dl-disable-generic.diff"
    "content-hash": "87b2074ab1d8a7ee59f719e26130ca36",
                ],
                "psr-4": {
                    "Amp\\Serialization\\": "src"
                }
diff --git a/youtube_dl/extractor/__init__.py b/youtube_dl/extractor/__init__.py
index 18d8dbcd6..4d3edfac3 100644
--- a/youtube_dl/extractor/__init__.py
@@ -13,7 +13,6 @@ except ImportError:
         for name, klass in globals().items()
         if name.endswith('IE') and name != 'GenericIE'
     ]
-    _ALL_CLASSES.append(GenericIE)
 
 
 def gen_extractor_classes():