FFmpeg HLS Unsafe File Extension Bypass Vulnerability

A vulnerability in FFmpeg's HLS demuxer allows for bypassing file extension checks that are meant to prevent unsafe files from being processed. This is achieved by appending certain file extensions to base64-encoded data URIs, which can then trigger arbitrary demuxers. The issue affects FFmpeg versions 2.0 through 6.0.

Impact

Exploitation of this vulnerability could lead to the processing of unsafe files, potentially allowing for the exfiltration of unintended data.

Reproduction

To reproduce this vulnerability, create an HLS playlist that includes base64-encoded data URIs. Initially, the HLS demuxer will block these URIs due to unsafe file extension concerns. However, by appending a valid media file extension, such as .m3u8, the extension check can be bypassed. Once the playlist is processed with the appended extension, the base64 data can be decoded and accessed, demonstrating the vulnerability.

Remediation

Users can update to a version of FFmpeg that includes the upstream commit addressing this vulnerability, which enforces proper file extension checks on HLS playlists.