GHSA-v8mc-9377-rwjj yt-dlp File Downloader cookie leak

• PyPI yt-dlp: < 2023.7.06 → fixed in 2023.7.06

Impact During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in all versions of youtube-dl, youtube-dlc and yt-dlp released since 2015.01.25. All native and external downloaders are affected, except for `curl` and `httpie` (httpie version 3.1.0 or later). At the file download stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped. An example of a potential attack scenario exploiting this vulnerability: 1. an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an unvalidated redirect to a target URL. 2. yt-dlp extracts this URL and calculates a `Cookie` header based on its domain for the file downloader to make its request(s) with. 3. the download URL redirects to a server controlled by the attacker, to which yt-dlp forwards the user's sensitive cookie information. Patches yt-dlp version 2023.07.06 fixes this issue by doing the following: • Remove the `Cookie` header upon HTTP redirects • Have native downloaders calculate their own `Cookie` header from the cookiejar • Utilize external downloaders' built-in support for cookies instead of passing them as header arguments • If the external downloader does not have proper cookie support, then disable HTTP redirection (`axel` only) • Process cookies passed as HTTP headers to limit their scope (`--add-header "Cookie:..."` is scoped to input URL domain only) • Store cookies in a separate `cookies` field of the info dict instead of `http_headers` so as not to lose their scope Patches for youtube-dl are expected and we will update this advisory when they are merged. Workarounds It is recommended to upgrade yt-dlp to version 2023.07.06 as soon as possible. For users who are not able to upgrade: • Avoid using cookies and user authentication methods (`--cookies`, `--cookies-from-browser`, `--username`, `--password`, `--netrc`). While extractors may set custom cookies, these usually do not contain sensitive information. • Avoid using `--load-info-json` Or, if authentication is a must: • Verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp • Use `curl` as external downloader, since it is not impacted (`--downloader curl`) • Avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM (use `-f "(bv*+ba/b)[protocol~='^https?$']"`) References • https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj • https://nvd.nist.gov/vuln/detail/CVE-2023-35934 • https://github.com/yt-dlp/yt-dlp/releases/tag/2023.07.06 • https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2023.07.06.185519 • https://github.com/yt-dlp/yt-dlp/commit/1ceb657bdd254ad961489e5060f2ccc7d556b729 • https://github.com/yt-dlp/yt-dlp/commit/f8b4bcc0a791274223723488bfbfc23ea3276641 • https://github.com/yt-dlp/yt-dlp/commit/3121512228487c9c690d3d39bfd2579addf96e07