{"id":"CVE-2022-24739","aliases":["EUVD-2022-1353","GHSA-75p7-527p-w8wp"],"status":"published","title":"Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltube","description":"alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00912,"percentile":0.60288,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601","CWE-918"],"published":"2022-03-08T21:40:10Z","modified":"2026-10-28T02:30:27Z","fixes":[{"ecosystem":"Packagist","package":"rudloff/alltube","fixed_in":["3.0.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"rudloff/alltube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"rudloff/alltube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.11.0","0.3.0","0.3.1","0.3.2","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.5.0","0.5.1","0.5.2","0.6.0","0.7.0","0.7.1","0.7.2-beta","0.7.2-beta2","0.8.0","0.8.1-beta","0.9.0","1.0.0","1.1.0","1.1.1","1.1.2","1.1.3","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.1.0","2.2.0","2.2.1","2.3.0","3.0.0","3.0.0-beta","3.0.0-beta2","3.0.0-beta3","3.0.0-beta4","3.0.0-beta5","3.0.1","3.0.2"]}],"products":[{"vendor":"alltube_project","product":"alltube"},{"vendor":"rudloff","product":"alltube"}],"references":[{"url":"https://github.com/Rudloff/alltube/security/advisories/GHSA-75p7-527p-w8wp","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","web"]},{"url":"https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/Rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24739","tags":["advisory"]},{"url":"https://github.com/ytdl-org/youtube-dl/issues/30691","tags":["web"]},{"url":"https://github.com/Rudloff/alltube/releases/tag/3.0.3","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/rudloff/alltube/CVE-2022-24739.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-75p7-527p-w8wp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24739.json","tags":["advisory"]},{"url":"https://github.com/Rudloff/alltube","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-24739","title":"Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltube","description":"alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.","status":"published","published":"2022-03-08T21:40:10Z","modified":"2025-04-23T18:56:39.899Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-601","CWE-918"],"updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-1353","description":"alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.","status":"published","published":"2022-03-08T21:40:10Z","modified":"2025-04-23T18:56:39Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:52:07.453218Z"}],"ghsa":[{"id":"GHSA-75p7-527p-w8wp","title":"Server-Side Request Forgery and Open Redirect in AllTube Download","description":"### Impact\n\nOn releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured).\n\nThe impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.)\n\n### Patches\n\n3.0.3 contains a fix for this vulnerability.\n(The 1.x and 2.x releases are not maintained anymore.)\n\nThe fix requires applying [a patch](https://github.com/Rudloff/alltube/blob/3d092891044f2685ed66c73c870a021bee319c37/patches/youtube-dl-disable-generic.diff) to youtube-dl to disable its generic extractor. If you are using the version of youtube-dl bundled with 3.0.3, it is already patched.\nHowever, if you are using your own unpatched version of youtube-dl **you might still be vulnerable**.\n\n### References\n\n* https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a\n* https://github.com/ytdl-org/youtube-dl/issues/30691\n","status":"published","published":"2022-03-09T15:17:31Z","modified":"2024-02-02T17:01:45Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-601","CWE-918"],"updated_at":"2026-11-02T14:37:34.405364Z"}],"nvd":[{"id":"CVE-2022-24739","description":"alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.","status":"published","published":"2022-03-08T22:15:07.757Z","modified":"2026-06-17T04:32:24.703Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601","CWE-918"],"updated_at":"2026-11-02T14:07:13.7085Z"}],"osv":[{"id":"CVE-2022-24739","title":"Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltube","description":"alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.","status":"published","published":"2022-03-08T21:40:10Z","modified":"2026-10-28T02:30:27.482354934Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-601","CWE-918"],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"GHSA-75p7-527p-w8wp","title":"Server-Side Request Forgery and Open Redirect in AllTube Download","description":"### Impact\n\nOn releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured).\n\nThe impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.)\n\n### Patches\n\n3.0.3 contains a fix for this vulnerability.\n(The 1.x and 2.x releases are not maintained anymore.)\n\nThe fix requires applying [a patch](https://github.com/Rudloff/alltube/blob/3d092891044f2685ed66c73c870a021bee319c37/patches/youtube-dl-disable-generic.diff) to youtube-dl to disable its generic extractor. If you are using the version of youtube-dl bundled with 3.0.3, it is already patched.\nHowever, if you are using your own unpatched version of youtube-dl **you might still be vulnerable**.\n\n### References\n\n* https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a\n* https://github.com/ytdl-org/youtube-dl/issues/30691\n","status":"published","published":"2022-03-09T15:17:31Z","modified":"2024-02-16T08:11:49.713841Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-601","CWE-918"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}