Executive Summary

This vulnerability exists in Streamlink versions prior to 8.4.0, specifically in its HLS and DASH parsers. These parsers do not validate the URI scheme of segment entries and other resources in video stream playlists or manifests. As a result, a remote playlist or manifest file can include a segment with a file URI scheme (e.g., file:///path/to/file). Streamlink will then read the specified local file on the user's system and write its contents to the output stream, potentially exposing local files unintentionally.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of local files on the user's system. An attacker who controls or can influence the remote playlist or manifest can cause Streamlink to read and output local files, potentially exposing sensitive information. This can compromise confidentiality, as indicated by the CVSS score which rates the impact on confidentiality as high.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Streamlink to version 8.4.0 or later, where the issue with URI scheme validation in HLS and DASH parsers has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows remote attackers to cause Streamlink to read and output local files, potentially exposing sensitive information such as user credentials or configuration files.

Exposure of sensitive personal or confidential data through this vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA, which require safeguarding personal and sensitive information against unauthorized access or disclosure.

Therefore, if exploited, this vulnerability may result in violations of these standards due to unauthorized data exposure, impacting confidentiality requirements mandated by such regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Streamlink versions 8.3.0 and earlier processing malicious HLS (.m3u8) or DASH (.mpd) playlists that contain file:// URIs, leading to arbitrary local file reads.

To detect exploitation attempts or presence of this vulnerability on your system or network, you can:

• Monitor network traffic for downloads or accesses of .m3u8 or .mpd playlist files containing file:// URIs.
• Inspect Streamlink command usage or logs for invocations processing remote playlists that might include suspicious file:// segments.
• Use commands to search for file:// URIs inside playlist files before processing them, for example:
• grep -r 'file://' /path/to/downloaded/playlists/
• If you have access to Streamlink logs or command history, check for commands like:
• streamlink <URL-of-remote-playlist>
• where the remote playlist URL might be hosting malicious content.

Additionally, ensure your Streamlink version is updated to 8.4.0 or later, which includes the fix preventing file:// URI processing.

Useful 0 Not Useful 0