# SSRF via media playlist references

Uploaded media reaching FFmpeg HLS/concat/subfile demuxers that fetch remote URLs or read local files

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; 2 confirmed bounties: $1,000 and $2,727; latest 2021-02-15. Updated 2026-10-23._

## How it works
A server-side media pipeline (demuxer, transcoder, preview generator) treats references inside an uploaded file as trusted instructions. FFmpeg's HLS demuxer, and related concat/subfile handling, will follow playlist entries that point at remote URLs or local paths. The broken assumption: that an uploaded media file is inert data. In practice the container can carry directives (HLS playlists, subtitle chunks, concat lists) that make the server issue outbound requests or read files it should never expose, then render the result back into the generated output.

## Where it shows up
- User uploads passed to FFmpeg/libavformat without a demuxer allowlist or network/file sandbox.
- HLS/m3u8, concat, or subfile references accepted from user-supplied media.
- Container/codec combinations (subtitle chunks such as GAB2, playlists) that reach external-fetch code paths.
- Preview/thumbnail generation that reflects fetched content back to the user.
- Transcoding workers with broad filesystem and network reach.

## How to review
The invariant: no reference inside user-supplied media may cause the server to open a network connection or read a path outside the job's own input. Check that the demuxer set is restricted, that protocols like file/http/concat/subfile are disabled for untrusted input, and that workers run sandboxed with no outbound network and no sensitive filesystem access. Confirm the generated output cannot echo back fetched bytes. If any playlist or external reference is honored, treat it as unsafe.

## Variants seen
- External SSRF plus local file read via HLS directives embedded in an uploaded AVI [E1](https://bugbountylibrary.com/r/h1%3A1062888.md).
- Local file disclosure via GAB2 subtitle chunks driving HLS processing, exfiltrated as video frames [E2](https://bugbountylibrary.com/r/h1%3A226756.md).
- Arbitrary file read via HLS parser in a photo upload preview pipeline [E3](https://bugbountylibrary.com/r/h1%3A487008.md).

## Why fixes fail
E1 shows the exploit is byte-sensitive: a trailing CRLF after the `?` broke the initial attempt, and success required trimming to the exact byte and iterating subfile offsets [E1](https://bugbountylibrary.com/r/h1%3A1062888.md). Fixes that only block obvious URLs, or that assume well-formed playlists, miss crafted byte-level payloads.

## Impact and severity
Led to SSRF and local file read (e.g. /etc/passwd) leaking into user-visible output [E1](https://bugbountylibrary.com/r/h1%3A1062888.md)[E3](https://bugbountylibrary.com/r/h1%3A487008.md). Severity is high where workers have network egress and filesystem access; worse when fetched content is reflected back, turning blind reads into full disclosure.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1062888.md
- E2: https://bugbountylibrary.com/r/h1%3A226756.md
- E3: https://bugbountylibrary.com/r/h1%3A487008.md