FFmpeg DASH Playlist Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in FFmpeg's DASH playlist support, specifically in versions 4.2 through 6.0. This flaw allows arbitrary HTTP GET requests to be made from the machine running FFmpeg, using a crafted DASH playlist that contains malicious URLs. The vulnerability arises because the DASH demuxer does not properly check the protocol whitelist before initiating HTTP requests, potentially leading to unauthorized access or data exfiltration.

Impact

Exploitation of this vulnerability allows for arbitrary HTTP GET requests to be sent on behalf of the affected machine, which could be used to access internal resources or exfiltrate data.

Reproduction

To reproduce this vulnerability, create a DASH playlist (MPD file) that includes a SegmentURL pointing to an attacker-controlled server. When FFmpeg processes this playlist, it will make a GET request to the specified URL, bypassing the protocol whitelist. This can be verified by checking the server logs for the incoming request.

Remediation

DASH playlists should be configured to restrict URIs to data:// and file:// protocols, unless otherwise specified with a protocol_whitelist.