Executive Summary

CVE-2020-37173 is an information disclosure vulnerability in AVideo Platform version 8.1 and earlier.

It allows unauthorized attackers to enumerate user details by exploiting the playlistsFromUser.json.php endpoint.

By manipulating the users_id parameter, attackers can retrieve sensitive user information such as email addresses, password hashes, and administrative status.

This vulnerability enables remote, unauthenticated attackers to access critical user data without any privileges or user interaction.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to significant information disclosure risks.

• Attackers can obtain sensitive user information including email addresses, password hashes, and administrative status.
• Exposure of password hashes and recovery tokens can facilitate further attacks such as password cracking or account takeover.
• Unauthorized access to administrative status information can help attackers identify high-value targets within the system.
• Since the attack requires no privileges or user interaction, it can be performed remotely and anonymously.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by attempting to access the endpoint /objects/playlistsFromUser.json.php with different users_id parameter values and observing if sensitive user information is returned without authorization.'}, {'type': 'paragraph', 'content': 'A simple detection command using curl on a Linux system could be:'}, {'type': 'list_item', 'content': 'curl -v "http://<target-server>/objects/playlistsFromUser.json.php?users_id=1"'}, {'type': 'paragraph', 'content': 'If the response contains user details such as email, password hash, or admin status, it indicates the presence of the vulnerability.'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the playlistsFromUser.json.php endpoint to authorized users only, for example by implementing authentication and authorization checks.

Additionally, updating the AVideo Platform to a version where this vulnerability is fixed or applying vendor-provided patches is recommended.

If patching is not immediately possible, consider blocking or filtering requests to the vulnerable endpoint at the network firewall or web application firewall level.

Useful 0 Not Useful 0