Stored XSS in AVideo Comment System via Malicious Markdown

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in WWBN AVideo versions 26.0 through 29.3.0. It allows authenticated users to inject malicious JavaScript via comments by exploiting the markDownToHTML() function, which preserves event-handler attributes like onerror in HTML blocks. Attackers can post a comment starting with an img tag containing an onerror handler, bypassing the inline sanitizer and executing the script in viewers' browsers under the application's origin.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect AVideo comment sections for malicious comments containing img tags with event handlers like onerror. Check for comments starting with <img src=x onerror=...>. Use browser developer tools to inspect rendered HTML of comments for unsanitized event attributes.

Useful 0 Not Useful 0

Impact Analysis

An attacker with comment permissions could inject JavaScript that runs in your browser when viewing the malicious comment. This could lead to session hijacking, theft of sensitive data, or unauthorized actions performed on your behalf within the application. The impact depends on your privileges and the application's data handling.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using affected AVideo versions may face compliance failures, potential fines, and reputational damage due to data breaches resulting from XSS exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable comment submission and display for untrusted users. Apply a strict HTML allowlist at rendering or enforce a restrictive CSP. Update to the patched version if available. Monitor comments for suspicious payloads like img tags with event handlers.

Useful 0 Not Useful 0