Viral Video - Exploiting SSRF in Video Converters

on YouTube ↗34m

" summary

Demonstrates that ffmpeg playlist handling enables SSRF and local-file reads by abusing ffmpeg hls m3u8 support and protocols like concat/subfile protocols, allowing payloads to be concatenated into videos or thumbnails and reconstructed to reveal whole files. Shows DNS-only, recursive and char‑by‑char exfiltration to bypass blocked HTTP, practical AWS/cloud takeover scenarios when conversion nodes hold credentials, a GitHub testing/exploit tool, and that fixes land in the latest ffmpeg release.

AI-written summary · about

" chapters (19)

1. 0:00Start
2. 3:16How FFmpeg works: user's view
3. 3:39How FFmpeg REALLY works
4. 4:00Look closer to FFmpeg: extension
5. 6:36HTTP Live Streaming - HLS
6. 8:07FFmpeg: concat
7. 9:06YUV4MPEG2
8. 14:47Exploit cons
9. 15:11Read full file
10. 17:23DEMO
11. 18:24Forgotten DNS
12. 19:31File enumeration
13. 20:39We can construct m3u8 from local file
14. 26:09ImageMagick
15. 27:35Video files in folder
16. 28:05Ubuntu Linux with FFmpeg
17. 28:26Kali Linux with GStreamer
18. 29:31Questions?
19. 33:14SSRF: read response

" related talks

• 50mA New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!Orange Tsai, Cheng-Da Tsai · CODE BLUE 2017
• 27mThe Most Dangerous Codec in the World: Finding and Exploiting Vulnerabilities in H.264 DecodersStephen Checkoway, Hovav Shacham, Willy R. Vasquez · Black Hat USA 2023
• 12mHaving H26Fun with H26Forge: Vulnerability Hunting, Datamoshing, and More!Willy R. Vasquez · Demuxed 2023
• 36m"Playing in the Sandbox: Adobe Flash Exploitation Tales"Björn Ruytenberg · CONFidence 2019
• 56mModern Web Vulnerabilities 2020Erlend Oftedal · NDC Security Oslo 2020
• 24mVideo streaming on the web: Live and recorded video streamingDoug Sillars · React Finland 2021
• 47mA New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!Orange Tsai · Black Hat Asia 2018
• 50m“The Upside Down” of the web, VideoMáté Nádasdi · jsDay 2018