T03 · Remote Payload Retrieval and Execution
Error
- Location
bgutil-ytdlp-pot-provider/server/src/session_manager.ts:271- Finding
Unauthenticated Remote JavaScript Retrieval and Execution
- Content
View full analysis
{ if (err) { console.error( `Could not listen on [::]:${PORT_NUMBER}, falling back to 0.0.0.0 (Caused by ${strerror(err)})`, ); } else { console.log( `Started POT server (v${VERSION}) on on address [::]:${PORT_NUMBER}`, ); } }, ) .on("error", () => { httpServer.listen( { host: "0.0.0.0", port: PORT_NUMBER, }, // ... ); }); ``` ```ts // server/src/main.ts:74-96 httpServer.post("/get_pot", async (request, response) => { const body = request.body || {}; const contentBinding: string | undefined = body.content_binding; const proxy: string = body.proxy; const bypassCache: boolean = body.bypass_cache || false; const sourceAddress: string | undefined = body.source_address; const disableTlsVerification: boolean = body.disable_tls_verification || false; try { const sessionData = await sessionManager.generatePoToken( contentBinding, proxy, bypassCache, sourceAddress, disableTlsVerification, body.challenge, body.innertube_context, ); response.send(sessionData); } catch (e) { // ... } }); ``` ```ts // server/src/session_manager.ts:271-312 const { program, globalName, interpreterHash } = challenge; const { privateDoNo ...[truncated 2982 chars]- Remediation
View remediation