Description

Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video_data endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services including cloud metadata endpoints and retrieve response bodies containing sensitive credentials through error messages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T15:17:41.707Z",
  "pubdate": "2026-09-04T15:17:41.707Z",
  "executiveSummary": "The Douyin_TikTok_Download_API, specifically versions up to 4.1.2, is susceptible to a Server-Side Request Forgery (SSRF) vulnerability.\nThis flaw exists within the /api/download and /api/hybrid/video_data endpoints, allowing an unauthenticated remote attacker to coerce the server into performing arbitrary HTTP requests.\nBy manipulating the url query parameter, an attacker can bypass network boundaries to interact with internal infrastructure, including sensitive cloud metadata services.\nThe primary risk stems from the potential for unauthorized data exfiltration, specifically the leakage of sensitive credentials or internal configuration data returned in verbose error messages.\nThe vulnerability requires no authentication, significantly lowering the barrier to exploitation and potentially exposing the internal network architecture of the hosting environment.\nSuccessful exploitation allows attackers to perform reconnaissance on internal systems and retrieve sensitive information, posing a critical security risk to systems utilizing this API.",
  "technicalDetails": "The vulnerability resides in the request processing logic of the /api/download and /api/hybrid/video_data endpoints. The application accepts a user-controlled 'url' parameter and performs an unvalidated server-side request to the provided location to facilitate video data retrieval.\nThe root cause is a failure to implement robust input validation or allowlisting for the 'url' parameter. The application fails to sanitize or restrict the input against known internal IP ranges, local addresses, or cloud-specific service endpoints (e.g., 169.254.169.254).\nThe attack flow proceeds as follows: 1) The unauthenticated attacker identifies the vulnerable endpoints. 2) The attacker crafts an HTTP request targeting an internal resource or sensitive metadata service via the 'url' query parameter. 3) The server-side application initiates an outbound connection to the specified URL. 4) The target internal service processes the request, potentially returning sensitive data (such as AWS/GCP/Azure IAM credentials, metadata, or environment variables). 5) The application captures the response or error message from the internal service and reflects the payload back to the attacker within the API response body.\nBecause the application directly exposes response bodies or descriptive error messages to the client, the attacker can extract secrets, environment credentials, or internal network topology information. The lack of authentication requirements on these endpoints allows any remote user to weaponize the server as an HTTP proxy or a tool for internal network reconnaissance.\nThis SSRF implementation provides the attacker with a pivot point into the internal network segment. By bypassing firewalls and perimeter security, the attacker can interact with services not intended for public access. If the application is hosted in a cloud environment, the ability to query metadata services for temporary security tokens represents a critical escalation path, potentially leading to full compromise of the underlying cloud instance or associated service accounts."
}