Douyin Tiktok Download Api
Monthly
Server-side request forgery in Douyin_TikTok_Download_API through version 4.1.2 exposes internal network resources and cloud instance credentials to unauthenticated remote attackers. The /api/download and /api/hybrid/video_data endpoints accept a user-supplied url query parameter without validation, allowing any caller to instruct the server to fetch arbitrary URLs - including cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254) - and read back full response bodies or error messages containing sensitive credentials. No vendor-released patch has been identified at time of analysis, and the GitHub issue tracker confirms the disclosure is public.
Server-side request forgery in Douyin_TikTok_Download_API through version 4.1.2 exposes internal network resources and cloud instance credentials to unauthenticated remote attackers. The /api/download and /api/hybrid/video_data endpoints accept a user-supplied url query parameter without validation, allowing any caller to instruct the server to fetch arbitrary URLs - including cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254) - and read back full response bodies or error messages containing sensitive credentials. No vendor-released patch has been identified at time of analysis, and the GitHub issue tracker confirms the disclosure is public.