local file disclosure via FFmpeg hls processing

Summary

Vulnerability in FFmpeg.

FFmpeg is video encoding software that is used by VK for preview generation and video conversion. FFmpeg is known to process HLS playlists that may contain references to external files. I was able to fire this feature using GAB2 subtitle chunks inside an AVI file. After that, I was able to retrieve conversion nodes' local files via XBIN codec, resulting in nice hackerish videos with file contents.

This issue was disclosed among others at Phdays conference 2017, the slides are available at https://docs.google.com/presentation/d/1yqWy_aE3dQNXAhW8kxMxRqtP7qMHaIfMzUDpEqFneos/edit, the screenshot of this particular issue (that is, the screenshot of the video showing /etc/passwd from a VK server) is near the end of the presentation.