CVE-2023-6605

What it actually does

The flaw permits Server-Side Request Forgery allowing arbitrary HTTP GET requests to be issued from the host running FFmpeg when a crafted DASH playlist supplies malicious URLs.

Why it matters to the business

Organizations processing untrusted media playlists face risk of internal network reconnaissance or data exfiltration through the media-processing host, raising exposure for any pipeline that ingests user-supplied DASH content.

How an attack unfolds

An attacker creates a DASH playlist embedding attacker-controlled URLs and supplies the playlist to FFmpeg; the application then issues the HTTP requests on behalf of the host, enabling interaction with internal services.

How to fix it

Upgrade affected FFmpeg installations to a version that corrects DASH playlist URL handling. For the listed Ubuntu packages apply the following updates: glibc (Ubuntu:16.04:LTS) to 2.23-0ubuntu6 and eglibc (Ubuntu:14.04:LTS) to 2.19-0ubuntu6.10.

How to confirm the fix worked

Confirm the installed FFmpeg binary reports a corrected version and test that crafted DASH playlists no longer trigger outbound requests to arbitrary hosts.

Typical attack path

1. Craft a malicious DASH playlist containing attacker-chosen URLs
2. Deliver the playlist to a target system that invokes FFmpeg
3. Trigger playlist parsing in FFmpeg
4. Observe or leverage the resulting outbound HTTP GET requests

How to detect it

Review FFmpeg process logs and outbound HTTP request logs for unexpected connections initiated during playlist processing; correlate with file-access events involving .mpd or DASH manifest files.

What your security team should do

• Prioritize patching FFmpeg in all media-processing workflows before the CISA-style deadlines if the package appears in KEV lists
• Restrict FFmpeg execution environments from reaching internal networks via egress controls
• Scan build and runtime dependencies for the listed glibc and eglibc versions and schedule upgrades