yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment variables. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2024.04.09 fixes this issue by properly escaping `%`. It replaces them with `%%cd:~,%`, a variable that expands to nothing, leaving only the leading percent. It is recommended to upgrade yt-dlp to version 2024.04.09 as soon as possible. Also, always be careful when using `--exec`, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade, avoid using any output template expansion in `--exec` other than `{}` (filepath); if expansion in `--exec` is needed, verify the fields you are using do not contain `"`, `|` or `&`; and/or instead of using `--exec`, write the info json and load the fields from it instead.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581     attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes.
    However, this escaping is not sufficient, and still allows expansion of environment variables. Support for     output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in     version 2021.04.11. yt-dlp version 2024.04.09 fixes this issue by properly escaping `%`. It replaces them     with `%%cd:~,%`, a variable that expands to nothing, leaving only the leading percent. It is recommended     to upgrade yt-dlp to version 2024.04.09 as soon as possible. Also, always be careful when using `--exec`,     because while this specific vulnerability has been patched, using unvalidated input in shell commands is     inherently dangerous. For Windows users who are not able to upgrade, avoid using any output template     expansion in `--exec` other than `{}` (filepath); if expansion in `--exec` is needed, verify the fields     you are using do not contain ``, `|` or `&`; and/or instead of using `--exec`, write the info json and     load the fields from it instead. (CVE-2024-22423)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:1138 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-22423:
    yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581     attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes.
    However, this escaping is not sufficient, and still allows expansion of environment variables. Support for     output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in     version 2021.04.11. yt-dlp version 2024.04.09 fixes this issue by properly escaping `%`. It replaces them     with `%%cd:~,%`, a variable that expands to nothing, leaving only the leading percent. It is recommended     to upgrade yt-dlp to version 2024.04.09 as soon as possible. Also, always be careful when using `--exec`,     because while this specific vulnerability has been patched, using unvalidated input in shell commands is     inherently dangerous. For Windows users who are not able to upgrade, avoid using any output template     expansion in `--exec` other than `{}` (filepath); if expansion in `--exec` is needed, verify the fields     you are using do not contain ``, `|` or `&`; and/or instead of using `--exec`, write the info json and     load the fields from it instead.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581
    attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes.
    However, this escaping is not sufficient, and still allows expansion of environment variables. Support for
    output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in
    version 2021.04.11. yt-dlp version 2024.04.09 fixes this issue by properly escaping `%`. It replaces them
    with `%%cd:~,%`, a variable that expands to nothing, leaving only the leading percent. It is recommended
    to upgrade yt-dlp to version 2024.04.09 as soon as possible. Also, always be careful when using `--exec`,
    because while this specific vulnerability has been patched, using unvalidated input in shell commands is
    inherently dangerous. For Windows users who are not able to upgrade, avoid using any output template
    expansion in `--exec` other than `{}` (filepath); if expansion in `--exec` is needed, verify the fields
    you are using do not contain `"`, `|` or `&`; and/or instead of using `--exec`, write the info json and
    load the fields from it instead. (CVE-2024-22423)

ID	Name	Product	Family	Type	Severity
244153	Linux Distros Unpatched Vulnerability : CVE-2024-22423	Nessus	Misc.	Local	critical
239475	TencentOS Server 4: yt-dlp (TSSA-2024:1138)	Nessus	Tencent Local Security Checks	Local	high
415816	SCA: security update for yt-dlp (GHSA-hjq6-52gw-2g7p)	Tenable Cloud Security	SCA Checks	Local	critical
415816	SCA: security update for yt-dlp (GHSA-hjq6-52gw-2g7p)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2024-22423

critical

Tenable Plugins

critical

high

critical

critical