# local file disclosure via FFmpeg hls processing

FFmpeg HLS processing triggered via GAB2 subtitle chunks in an AVI let attacker read local files from VK conversion nodes, exfiltrated as video frames.

- Payout: $1,000
- Severity: high
- Program: VK.com
- Credited: neex
- Disclosed: 2017-06-24
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/226756
- Library page: https://bugbountylibrary.com/r/h1%3A226756
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:linux technique:source-review vuln:info-disclosure vuln:ssrf

**Target:** FFmpeg video conversion/preview pipeline
**Root cause:** FFmpeg's HLS demuxer follows external file references in playlists; attacker-controlled AVI with GAB2 subtitle chunks caused FFmpeg to process an HLS playlist referencing local files, which were then rendered via XBIN codec into output video.
**Steps:**
1. Craft AVI file containing GAB2 subtitle chunks that embed/trigger an HLS playlist referencing `file:///etc/passwd`
2. Upload to VK video conversion/preview pipeline
3. FFmpeg processes HLS, reads local file on conversion node
4. XBIN codec renders file contents as video frames
5. Download resulting video and read leaked file contents
**How found:** Researcher knew FFmpeg HLS playlists can reference external files, then found GAB2 subtitle chunks in AVI as a delivery vector to reach that code path in VK's conversion pipeline.
**Exploitation:** Upload malicious AVI to VK; conversion node's FFmpeg reads arbitrary local files via HLS external reference and encodes them into the output video using XBIN, which the attacker then downloads.
**Insight:** Media pipelines that shell out to FFmpeg are attack surface: look for container/codec combinations (subtitles, playlists, concat) that make FFmpeg fetch or read external resources, and use an output codec that renders raw bytes so leaked data survives transcoding.