地图 / External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processing

External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processing

服务端请求伪造 / SSRF / #1062888

厂商: TikTok
严重程度: 中危 · CVSS 7.7
赏金: $2,727
弱点: SSRF
研究员: @ach
披露日期: 2021-02-15
资产: *.tiktok.com
CVE: —

该报告还没有中文解读。

时间线

2020-12-20报告提交
2021-02-15公开披露

阅读 HackerOne 原文 ↗作者 @ach · 版权归作者与 TikTok 所有

同类报告

SSRF in Exchange leads to ROOT access in all instancesShopify · 2018-05-23 Server Side Request Forgery (SSRF) via Analytics ReportsHackerOne · 2023-12-08 · $25,000 Server-Side Request Forgery using Javascript allows to exfill data from Google MetadataSnapchat · 2020-11-30 Server Side Request Forgery (SSRF) at app.hellosign.com leads to AWS private keys disclosureDropbox · — · $4,913 SSRF on project import via the remote_attachment_url on a NoteGitLab · 2020-06-07 · $10,000 Server Side Request Forgery mitigation bypassGitLab · 2020-04-18