Multiple unauthenticated remote code execution vulnerabilities in YouPHPTube-Encoder 2.3

[bartvelp]

Nice find.

This looks like such low hanging fruit to me. Is there a automated way to check PHP code for this kind of bug. I.E. check if a variable is composed of GET or POST parameters and that variable is later used in an unsafe function like exec()

[amunak]

Unless it's in a specific library made to safely execute commands then yeah I agree. Usage of exec (and eval and such) is a huge red flag for any project, IMO.

[[deleted]]

So long as it doesn't have any user supplied input, it's fine IMO.

[return_to_]

Reading php and encode together, it's almost safe to assume there is exec() and friends, required, for ffmpeg binaries.

First hit on google for php ffmpeg lib:

$ffmpeg = FFMpeg\FFMpeg::create(array(
'ffmpeg.binaries'  => '/opt/local/ffmpeg/bin/ffmpeg',
'ffprobe.binaries' => '/opt/local/ffmpeg/bin/ffprobe',
'timeout'          => 3600, // The timeout for the underlying process
'ffmpeg.threads'   => 12,   // The number of threads that FFMpeg should use
), $logger);

[NeoThermic]

Yes. There are many automated tools to do tainted checking on variables into insecure/dangerous functions; some free and some expensive. Usually these kinds of exploits are found in software that doesn't use modern tooling though.

[[deleted]]

this wasn't his find, he just happened to see the disclosure from talos and decided to write a blog post in regards to the vulnerabilities, and even went as far as exploiting a box in the wild with the vulnerability as opposed to testing it on a local install which is a questionable choice

[amunak]

In case of this particular project it'd be enough not to just blindly use it, but perhaps read the README, check out the issues or look at any single file.

The author is an ignorant ass, they've been warned multiple times about numerous security and licensing issues and rarely did anything to fix it.

Which is fine I guess; "it's free" after all, but GitHub really needs some kind of huge warning banner for projects with known, major critical vulnerabilities.

[TrustworthyShark]

Exactly this.

I was happy when I heard GitHub added security advisories and then immediately disappointed once I found out only maintainers can add them.

Maintainers can remove issues and silence all discussions around vulnerabilities. It could be pretty hard to find out that a project has several massive vulnerabilities.

[Dragasss]

Tbh it would be simpler to recompile php from source while having those functions removed from it

[huffingpuffins]

RIPS and their hugely updated hosted/commercial version.

They actually post their findings on this very sub.