FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 2
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Ffmpeg Ffmpeg
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
|
— |
7.1.4
|
|
Ffmpeg Ffmpeg
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
|
8.0
|
8.0.2
|
References 8
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292
disclosure@vulncheck.com
https://github.com/FFmpeg/FFmpeg
disclosure@vulncheck.com
https://github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016
disclosure@vulncheck.com
https://github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9
disclosure@vulncheck.com
https://github.com/FFmpeg/FFmpeg/commit/7c011995e394
disclosure@vulncheck.com
https://github.com/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1
disclosure@vulncheck.com
https://github.com/FFmpeg/FFmpeg/commit/f9aa8729bce1
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/ffmpeg-before-7.1.4-and-8.0.2-ssrf-via-rts…
disclosure@vulncheck.com