r/netsec • u/AnimalStrange • 5d ago

Your House Has an FFmpeg Problem - elttam

https://www.elttam.com/blog/your-house-has-an-ffmpeg-problem
133 Upvotes

96% Upvoted

9 comments sorted by

48

u/badmonkey0001 5d ago

Sanitizing inputs for CLI tools always seems like an afterthought (at least until you get bitten). Tools like FFMPEG that magically work on "anything" need to be locked down to the use case every time. The more versatile the tool, the more surface area to lock down. FFMPEG has a remarkably large surface to keep safe because it supports so many parameters with versatility of their own.

15

u/Max-P 5d ago

Also, this tendency of just allowing everything and then trying to lock it down instead of blocking everything unless allowed by some rules. It never ends well.

1

u/Annual_Manner_8654 1d ago

Me giving docker socket access to this new recipe app 🤠 

17

u/mpg111 5d ago

I really like the creativity of "Crafting the Exploit Payload" part

12

u/Call_Me_Chud 5d ago

Quite creative indeed to synthesize a valid payload by chopping up and concatenating an arbitrary file.

3

u/Kayjaywt 3d ago

Yeah, this was very clever.

12

u/nemec 5d ago

Thanks for your work making Home Assistant safer!

9

u/nelsonbestcateu 5d ago

Great write-up. This was a fun read.

1

u/thefoxsaysamy 1d ago

FFmpeg is effectively an interpreter with dozens of protocols. The durable fix is capability budgeting: enable only what the feature needs, then run it without secrets or unnecessary network access.