Zaloguj się
Deutsch English Español Polski
Średnia

WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

  • Ujawniono: 08.04.2026
  • Aktualizacja: 11.10.2026 10:22

Summary

The Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers.

The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services through the restream log feature.

Details

The vulnerable chain was:

  1. plugin/Live/view/getRestream.json.php exposed a fresh tokenForAction
  2. plugin/Live/view/Live_restreams/verifyTokenForAction.json.php exchanged it for a valid responseToken
  3. plugin/Live/view/Live_restreams_logs/add.json.php accepted attacker-controlled restreamerURL
  4. plugin/Live/view/getRestream.json.php and plugin/Live/view/Live_restreams/getAction.json.php later fetched that stored URL server-side

The original issue existed because the responseToken was accepted, but the callback destination was not tightly constrained to trusted restreamer endpoints.

The maintainer confirmed the vulnerability and stated that the fix was applied by validating restreamerURL at storage time and re-validating the log-entry branch before use. The maintainer also noted that the m3u8 field follows the same general pattern but is not server-fetched in the current flow.

Proof of concept

  1. Log in as a non-admin user with streaming permission.
  2. Create a normal restream destination.
  3. Trigger plugin/Live/view/Live_restreams/testRestreamer.json.php to create a live transmission history row.
  4. Call:
GET /plugin/Live/view/getRestream.json.php?live_transmitions_history_id=<id>&restreams_id=<id>
  1. Extract tokenForAction from the returned URL.
  2. Exchange it for responseToken via:
POST /plugin/Live/view/Live_restreams/verifyTokenForAction.json.php
  1. Store a loopback callback URL:
POST /plugin/Live/view/Live_restreams_logs/add.json.php
restreamerURL=http://127.0.0.1:9999/index.php
  1. Trigger getRestream.json.php again.
  2. Observe that the returned response now contains the JSON body from the loopback-only service.

Impact

An authenticated streamer can cause the AVideo server to send HTTP requests to loopback or internal services and return the response through normal application endpoints by storing a malicious restreamerURL in the restream log flow. Because the callback destination was not constrained to trusted restreamer endpoints, the application could be used as a proxy to internal-only services that trust network locality. Successful exploitation can expose local admin panels, internal-only APIs, cloud metadata services if reachable, or other sensitive internal responses available from the application host.

Recommended fix

  • Validate restreamerURL against explicitly configured restreamer endpoints at storage time
  • Re-validate the stored callback URL before server-side fetch
  • Bind responseToken to the expected restream row and callback host
  • Apply SSRF validation to the initial destination of every server-side fetch, not only redirect targets
  • Ignore or reject user-supplied callback hosts that do not match trusted configuration

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Paczka Composer WWBN/AVideo <= 26.0 brak poprawki

Odnośniki

Ocena CVSS 6.5/10
Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Słabość (CWE)
CWE-918
Platforma
Composer
Paczka
WWBN/AVideo
Ujawniono
08.04.2026
Aktualizacja
11.10.2026 10:22

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-q4x6-6mm2-crg9 - CC BY 4.0

Historia podatności: WWBN/AVideo

Wszystkie opisane podatności tej paczki (Paczka Composer), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (160) w archiwum
Wszystkich wpisów
160
Pierwsza → ostatnia
04.2022 06.2026
Bez poprawki
143
Wykorzystywana w atakach
0

Rozkład istotności

  • Krytyczna 14
  • Wysoka 61
  • Średnia 83
  • Niska 2

Ujawnienia w latach

Istotność:
  1. AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
    Wysoka · 8.1 CVE-2026-55173 <= 29.0 brak poprawki
  2. AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
    Wysoka · 7.5 CVE-2026-33692 < 29.0 29.0
  3. WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
    Krytyczna · 9.6 CVE-2026-54458 <= 29.0 brak poprawki
  4. WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)
    Wysoka CVE-2026-49279 <= 29.0 brak poprawki
  5. WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint
    Wysoka · 4.3 CVE-2026-47696 <= 29.0 brak poprawki
  6. AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
    Wysoka · 8.8 CVE-2026-45578 <= 29.0 brak poprawki
  7. AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin
    Wysoka · 8.1 CVE-2026-56345 <= 29.0 brak poprawki
  8. AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization
    Wysoka CVE-2026-43885 <= 29.0 brak poprawki
  9. AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()
    Wysoka · 7.7 CVE-2026-43884 <= 29.0 brak poprawki
  10. AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass
    Wysoka · 7.2 CVE-2026-43874 <= 29.0 brak poprawki
  11. AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server
    Wysoka · 7.5 CVE-2026-43873 <= 29.0 brak poprawki
  12. WWBN AVideo: RCE cause by clonesite plugin
    Wysoka · 9.8 CVE-2026-41304 <= 29.0 brak poprawki
  13. WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection
    Wysoka · 9.3 CVE-2026-41064 <= 29.0 brak poprawki
  14. WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
    Wysoka · 7.7 CVE-2026-41060 <= 29.0 brak poprawki
  15. WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses
    Wysoka · 7.1 CVE-2026-41057 <= 29.0 brak poprawki
  16. WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover
    Wysoka · 8.1 CVE-2026-41056 <= 29.0 brak poprawki
  17. WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)
    Wysoka · 7.1 CVE-2026-40926 <= 29.0 brak poprawki
  18. WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
    Wysoka · 8.3 CVE-2026-40925 <= 29.0 brak poprawki
  19. WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
    Krytyczna · 10.0 CVE-2026-40911 <= 29.0 brak poprawki
  20. WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
    Wysoka · 8.7 CVE-2026-40909 <= 29.0 brak poprawki
  21. WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)
    Wysoka · 7.1 CVE-2026-39370 <= 26.0 brak poprawki
  22. WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs
    Wysoka · 7.6 CVE-2026-39369 <= 26.0 brak poprawki
  23. WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services ten wpis
    Średnia · 6.5 CVE-2026-39368 <= 26.0 brak poprawki
  24. AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php
    Wysoka · 7.5 CVE-2026-34731 <= 26.0 brak poprawki
  25. AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking
    Wysoka · 8.1 CVE-2026-34394 <= 26.0 brak poprawki
  26. AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page
    Wysoka · 8.2 CVE-2026-34375 <= 26.0 brak poprawki
  27. AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records
    Wysoka · 7.5 CVE-2026-56341 <= 26.0 brak poprawki
  28. AVideo has Plaintext Video Password Storage
    Krytyczna CVE-2026-33867 <= 26.0 brak poprawki
  29. AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables
    Wysoka CVE-2026-33770 <= 26.0 brak poprawki
  30. AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query
    Wysoka CVE-2026-33767 < 26.0 26.0
  31. AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter
    Wysoka · 7.1 CVE-2026-33723 <= 26.0 brak poprawki
  32. AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment
    Wysoka · 8.6 CVE-2026-33719 <= 26.0 brak poprawki
  33. AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL
    Wysoka · 8.8 CVE-2026-33717 <= 26.0 brak poprawki
  34. AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
    Krytyczna · 9.4 CVE-2026-33716 <= 26.0 brak poprawki
  35. AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name
    Wysoka · 7.2 CVE-2026-33681 <= 26.0 brak poprawki
  36. AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()
    Wysoka · 8.1 CVE-2026-33651 <= 26.0 brak poprawki
  37. AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion
    Wysoka · 7.6 CVE-2026-33650 <= 26.0 brak poprawki
  38. AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification
    Wysoka · 8.1 CVE-2026-33649 <= 26.0 brak poprawki
  39. AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path
    Wysoka · 8.8 CVE-2026-33648 <= 26.0 brak poprawki
  40. AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
    Wysoka · 8.8 CVE-2026-33647 <= 26.0 brak poprawki
  41. AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)
    Wysoka · 8.6 CVE-2026-33513 <= 26.0 brak poprawki
  42. AVideo has an unauthenticated decrypt oracle leaking any ciphertext
    Wysoka · 7.5 CVE-2026-33512 <= 26.0 brak poprawki
  43. AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload
    Wysoka · 8.8 CVE-2026-33507 <= 26.0 brak poprawki
  44. AVideo has Unauthenticated SSRF via plugin/Live/test.php
    Krytyczna · 9.3 CVE-2026-33502 <= 26.0 brak poprawki
  45. AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter
    Wysoka · 7.1 CVE-2026-33493 <= 26.0 brak poprawki
  46. AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration
    Wysoka · 7.3 CVE-2026-33492 <= 26.0 brak poprawki
  47. AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin
    Wysoka · 7.4 CVE-2026-33488 <= 26.0 brak poprawki
  48. AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter
    Wysoka · 7.5 CVE-2026-33485 <= 26.0 brak poprawki
  49. AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php
    Wysoka · 7.5 CVE-2026-33483 <= 26.0 brak poprawki
  50. AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()
    Wysoka · 8.1 CVE-2026-33482 <= 26.0 brak poprawki
  51. AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy
    Wysoka · 8.6 CVE-2026-33480 <= 26.0 brak poprawki
  52. AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin
    Wysoka · 8.8 CVE-2026-33479 <= 26.0 brak poprawki
  53. AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
    Krytyczna · 10.0 CVE-2026-33478 <= 26.0 brak poprawki
  54. AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`
    Wysoka · 7.6 CVE-2026-33354 <= 26.0 brak poprawki
  55. AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)
    Krytyczna · 9.8 CVE-2026-33352 <= 26.0 brak poprawki
  56. AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
    Krytyczna · 9.1 CVE-2026-33351 <= 26.0 brak poprawki
  57. AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php
    Wysoka CVE-2026-33295 <= 25.0 brak poprawki
  58. AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
    Wysoka · 8.1 CVE-2026-33293 <= 25.0 brak poprawki
  59. AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
    Wysoka · 7.5 CVE-2026-33292 <= 25.0 brak poprawki
  60. AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
    Wysoka · 8.6 CVE-2026-33039 <= 25.0 brak poprawki
Pokaż więcej (16) Widać 60 z 76

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.