[FFmpeg-devel] [PATCH 2/3] avformat/imfdec: fail on probing non xml file extension

[Michael Niedermayer]

On Sun, May 07, 2023 at 10:09:58PM -0700, Pierre-Anthony Lemieux wrote:
> On Sun, May 7, 2023 at 12:18 PM Michael Niedermayer
> <michael at niedermayer.cc> wrote:
> >
> > On Sat, May 06, 2023 at 11:01:20AM -0700, Pierre-Anthony Lemieux wrote:
> > > On Sat, May 6, 2023 at 6:25 AM Michael Niedermayer
> > > <michael at niedermayer.cc> wrote:
> > > >
> > > > Its unexpected that a .avi or other "standard" file turns into a playlist.
> > > > The goal of this patch is to avoid this unexpected behavior and possible
> > > > privacy or security differences.
> > >
> > > Per the IMF specification, a CPL can have any extension or, in fact,
> > > no extension. The latter is routinely used.
> >
> > is there a restriction on the URL/URIs used in it ?
> > that is in practice, can they be restricted to the same server,
> > child directories, or some other restriction ?
> 
> Below is a brief overview of the linkage between the various of
> components of an IMF composition:
> 
> - the Composition Playlist (CPL) is the file that is passed to FFMPEG
> as input (-i)
> - the CPL is an XML document and defines a playlist
> - each of the components that make up the playlist is identified by a
> UUID, i.e. the CPL does not contain file paths/URLs.
> - the mapping between UUIDs and URLs is done through separate XML
> files called Asset Maps. Paths to Asset Maps can be provided
> explicitly through the "-assetmaps" argument, otherwise FFMPEG looks
> for a file called "ASSETMAP.xml" in the same directory as the CPL
> file.
> - according to the standard, all URLs in each Asset Map is relative to
> the location of the Asset Map, and thus the CPL and the Asset Map have
> the same origin
> - some applications have relaxed this constraint and allowed absolute
> URLs in the Asset Map

Thank you for this information


> 
> What is the threat scenario? Is the concern that a malicious actor
> provides a CPL and Asset Map from origin A that makes malicious
> requests to a different origin B?

I do not have an exhaustive list of what can be done, but ill list a
few things i can think of with some random ideas.

First if i pretend to be the attacker, i want one file not 2 because
thats easier
can i just send the victim a ASSETMAP.xml that parses correctly as
CPL too ?
If yes, i think that can be checked for and trigger an error because
i dont think a valid file would use itself as assetmap
we could go a bit further here and play with things like
ASSETMAP.xml?video.avi
or something like that to make the link look more normal
i didint look at if that would work but it just makes it more harmless looking

now what can one do with this 

A Spying
1. User downloads a video file
now every time she plays the file, the file pings a URL revealing time, frequency and IP of the watched file
This is probably not expected by the user

B1 Poking
1. User downloads or plays a video file
now the file refers to various urls testing the users local network and network services
timing of remote accesses reveals this to an attacker
This is probably not expected by the user either

B2 same as B1 but a attacker uploads the file to a server where the attacker pokes around using it

B3 the URL requests to other services may or may not be able to do more than just reading

C DOS
a attacker uploads a file with many references and lets the server repeatly attempt connections
to them
This one is tricky because we liekly want to continue if one reference fails 
but also not do thousands of odd accesses to anything

This could plausibly even be used to bruteforcing some auth parameters
upload a file with all 4 digit pin codes in their URL and then depending on
what is encoding, maybe what length the resulting encoded file has one could
maybe figure out which URL access succeeded. 

Iam not an expert in this so quite likely theres more that can be done that
iam not thinking of

Thus anything that isnt part of normal use cases, i suggest to not allow by default
(like for example a ASSETMAP.xml thats also a valid CPL file)

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The real ebay dictionary, page 1
"Used only once"    - "Some unspecified defect prevented a second use"
"In good condition" - "Can be repaird by experienced expert"
"As is" - "You wouldnt want it even if you were payed for it, if you knew ..."
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20230508/8256c559/attachment.sig>