Executive brief
Open edX is a platform that hosts online courses and training content. The video download feature in Studio (the course authoring tool) allows teachers to download videos associated with their course. An attacker with course authoring access could exploit this to retrieve sensitive data from internal servers or cloud metadata services by providing malicious video URLs, which the platform would fetch server-side and return to the attacker.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the PUT /api/contentstore/v1/videos/{course_id}/download endpoint. The endpoint accepts user-supplied URLs in a files[].url parameter, performs an unauthenticated server-side fetch using requests.get(url, allow_redirects=True), and returns the fetched bytes in a ZIP response. Because URLs are not validated against an allowlist before fetching, an authenticated user with studio read access can point them at internal services or cloud metadata endpoints and exfiltrate responses. The issue requires authentication and studio read access, but no URL validation or timeout exists in the vulnerable fetch path. The fix (commit 00b7c3c and 241b914) implements URL validation by restricting fetches to an allowlist of legitimate course video URLs before any HTTP request is made.
Affected products
- Open edX Open edX Platform Prior to commit 00b7c3c
Timeline
- 2026-09-02: disclosed: CVE-2026-55421 published
- 2026-06-12: patched: Fix merged via commits 00b7c3c and 241b914