Security Vulnerability in Pioneer Rekordbox • Hacker News Board

Re: Security Vulnerability in Pioneer Rekordbox

#11

Post by cedws » Tue, Aug 11, 2026, 1:36 AM UTC

j-scott wrote: post #2

Rekordbox is one of the worst pieces of software I have to interact with regularly, and it reminds me of others descriptions of IoT software/firmware. "PRO DJ LINK" enables you to access rekordbox libraries (and load music files) remotely from other devices, whether that be on a computer or dedicated Pioneer/AlphaTheta hardware. The vulnerability in question requires the attacker to be on the same local network as th…

I dabbled with it for a while and hated how I couldn’t work with the library programatically. A few people found a way to decrypt the database (yes, it’s encrypted for obfuscation, rolls eyes) and manipulate it but it’s akin to brain surgery.

Re: Security Vulnerability in Pioneer Rekordbox

#12

Post by brokenmachine » Tue, Aug 11, 2026, 6:08 AM UTC

butterknife wrote: post #8

j-scott wrote: post #2

Rekordbox is one of the worst pieces of software I have to interact with regularly, and it reminds me of others descriptions of IoT software/firmware. "PRO DJ LINK" enables you to access rekordbox libraries (and load music files) remotely from other devices, whether that be on a computer or dedicated Pioneer/AlphaTheta hardware. The vulnerability in question requires the attacker to be on the same local network as th…

Truly terrible platform. I engineer DJ events and every single time there will be someone who had used either too new or too old version of rekordbox for the model of CDJ/controller the venue got in. This is seemingly random and totally undocumented. If I had hair I would have torn them out long time ago.

Do DJs just use whatever equipment is at the venue?

Don't they bring their own setup?

Re: Security Vulnerability in Pioneer Rekordbox

#13

Post by j-scott » Tue, Aug 11, 2026, 6:17 AM UTC

brokenmachine wrote: post #12

butterknife wrote: post #8

Earlier quoted context omitted.

Truly terrible platform. I engineer DJ events and every single time there will be someone who had used either too new or too old version of rekordbox for the model of CDJ/controller the venue got in. This is seemingly random and totally undocumented. If I had hair I would have torn them out long time ago.

Do DJs just use whatever equipment is at the venue? Don't they bring their own setup?

DJs are typically playing on promoter or venue provided equipment, which is usually industry standard of pioneer/AT.

Otherwise, they bring their own, especially if it’s anything custom or specific to their performance.

Re: Security Vulnerability in Pioneer Rekordbox

#14

Post by brokenmachine » Tue, Aug 11, 2026, 6:26 AM UTC

I bet it's a path traversal bug, like you request a listing for files named "../../.." or something.

I love it how they say to update, but there's no point because it won't fix the vulnerability anyway.

Re: Security Vulnerability in Pioneer Rekordbox

#15

Post by butterknife » Tue, Aug 11, 2026, 7:16 AM UTC

brokenmachine wrote: post #12

butterknife wrote: post #8

Earlier quoted context omitted.

Truly terrible platform. I engineer DJ events and every single time there will be someone who had used either too new or too old version of rekordbox for the model of CDJ/controller the venue got in. This is seemingly random and totally undocumented. If I had hair I would have torn them out long time ago.

Do DJs just use whatever equipment is at the venue? Don't they bring their own setup?

There are some DJs who lug their own Pioneer controllers with them. Precisely because they can make sure that their library will work! No other reason.

Re: Security Vulnerability in Pioneer Rekordbox

#16

Post by chipheadi » Tue, Aug 11, 2026, 7:17 AM UTC

butterknife wrote: post #8

j-scott wrote: post #2

Rekordbox is one of the worst pieces of software I have to interact with regularly, and it reminds me of others descriptions of IoT software/firmware. "PRO DJ LINK" enables you to access rekordbox libraries (and load music files) remotely from other devices, whether that be on a computer or dedicated Pioneer/AlphaTheta hardware. The vulnerability in question requires the attacker to be on the same local network as th…

Truly terrible platform. I engineer DJ events and every single time there will be someone who had used either too new or too old version of rekordbox for the model of CDJ/controller the venue got in. This is seemingly random and totally undocumented. If I had hair I would have torn them out long time ago.

For this exact case I have built https://chiph.art/en/project/2026/dj-usb-toolkit

The parity repair in the app should make the USB compatible with all CDJs because it makes both of the DBs identical.

I have also been able to repair the DBs that have been corrupted for example by disconnecting USB while Rekordbox is exporting to it.

I'm also just now building a website where you can send the DB repair requests for cases that need special attention.

Re: Security Vulnerability in Pioneer Rekordbox

#17

Post by butterknife » Tue, Aug 11, 2026, 12:51 PM UTC

chipheadi wrote: post #16

butterknife wrote: post #8

Earlier quoted context omitted.

Truly terrible platform. I engineer DJ events and every single time there will be someone who had used either too new or too old version of rekordbox for the model of CDJ/controller the venue got in. This is seemingly random and totally undocumented. If I had hair I would have torn them out long time ago.

For this exact case I have built https://chiph.art/en/project/2026/dj-usb-toolkit The parity repair in the app should make the USB compatible with all CDJs because it makes both of the DBs identical. I have also been able to repair the DBs that have been corrupted for example by disconnecting USB while Rekordbox is exporting to it. I'm also just now building a website where you can send the DB repair requests for cas…

I will make my DJ friends test this. Thank you.

Re: Security Vulnerability in Pioneer Rekordbox

#18

Post by MadnessASAP » Tue, Aug 11, 2026, 4:30 PM UTC

j-scott wrote: post #6

MadnessASAP wrote: post #4

Earlier quoted context omitted.

I too also have a special place of hate for Rekordbox. However I'm somewhat confused by this vulnerability, isn't plug n play unauthenticated file access essentially a core feature of "PRO DJ LINK"? The security mitigation, and best practice, being to have the involved devices connected on a entirely private LAN. I've never tried connecting them to a "public" network.

The feature definitely does what it says it does, but I think that the mount is generally accessible outside the software may be where the “surprise” lies. I definitely would not have used this feature on a public network or exposed the mount to the open internet as well.

You and crtasm both make an excellent point about where the problem lies. I suffered from a critical imagination failure by never considering the implications of running the link on anything other then a controlled and isolated network.