An unauthenticated server-side request forgery vulnerability in Douyin_TikTok_Download_API allows remote attackers to access internal network resources and sensitive metadata.

This vulnerability occurs due to improper validation of the url query parameter within the /api/download and /api/hybrid/video_data endpoints. An unauthenticated attacker can exploit this flaw to force the server to perform arbitrary HTTP requests, potentially reaching internal services or cloud metadata endpoints.

Successful exploitation allows an attacker to bypass network perimeters and interact with internal services that are not exposed to the public internet. This can lead to the exfiltration of sensitive configuration credentials, access to cloud metadata, or unauthorized interaction with internal APIs, resulting in significant data compromise. Given the CVSS score of 7.5, this high-severity flaw represents a substantial risk to organizational confidentiality and infrastructure integrity.

Immediate Action: Update to the latest version of Douyin_TikTok_Download_API beyond 4.1.2 to incorporate the upstream fixes provided by the maintainers.

Proactive Monitoring: Review web server access logs for anomalous requests to the /api/download and /api/hybrid/video_data endpoints that include internal IP addresses or sensitive service URLs in the query parameters.

Compensating Controls: Implement strict egress filtering on the host running the API to restrict outbound connections to only necessary external domains, preventing the server from reaching internal or unauthorized infrastructure.

Public Exploit Available: No

Organizations utilizing this API should prioritize the application of the vendor update to mitigate this critical SSRF exposure. Given the availability of proof-of-concept information, the window for remediation is limited before potential automated exploitation attempts occur. Immediate patching or the implementation of network-level egress restrictions is strongly advised to protect internal resources.