CyberRota Analysis
AI-GeneratedThe Streambert Electron Desktop App versions prior to 2.5.0 are vulnerable due to a flaw in the downloadSubtitleFile utility, which allows a compromised renderer to manipulate file paths and copy sensitive local files to attacker-specified locations. This could lead to unauthorized access to sensitive data and the potential overwriting of existing files. Organizations using affected versions should prioritize upgrading to version 2.5.0 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0.