Executive Summary

[{'type': 'paragraph', 'content': 'The vulnerability in WWBN AVideo versions 25.0 and below arises from the official Docker deployment files shipping with a default admin password set to "password". This password is automatically used to create the admin account during installation if the operator does not override the SYSTEM_ADMIN_PASSWORD environment variable.'}, {'type': 'paragraph', 'content': 'There are no compensating controls such as forced password changes, complexity validation, or detection of default passwords. Additionally, the password is hashed using the weak MD5 algorithm.'}, {'type': 'paragraph', 'content': 'This insecure default extends to database credentials as well, which are also set to trivial values.'}, {'type': 'paragraph', 'content': 'Exploitation depends on operators failing to change these defaults, which is likely in quick-start, demo, or automated deployments.'}, {'type': 'paragraph', 'content': 'The vulnerability allows trivial administrative takeover, enabling full admin access.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker to gain full administrative access to any AVideo instance deployed with the default credentials.

• Exposure of all user data and videos stored on the platform.
• Ability to modify, delete, or inject content on the platform.
• Potential for remote code execution through admin features such as file uploads and plugin management.
• Facilitation of credential stuffing attacks due to predictable default passwords.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking if the AVideo instance is using the default admin password "password" or default database credentials (avideo/avideo). Since the default password is hashed with MD5 as 5f4dcc3b5aa765d61d8327deb882cf99, you can verify if the admin account password hash matches this value.'}, {'type': 'paragraph', 'content': 'You can also inspect the deployment files such as `docker-compose.yml` and `.env` files to see if the environment variable SYSTEM_ADMIN_PASSWORD is unset or set to "password".'}, {'type': 'paragraph', 'content': 'Suggested commands include:'}, {'type': 'list_item', 'content': 'Check environment variables in the running container or deployment files for SYSTEM_ADMIN_PASSWORD: `grep SYSTEM_ADMIN_PASSWORD docker-compose.yml .env`'}, {'type': 'list_item', 'content': 'Check if the admin password hash in the database matches the MD5 hash of "password": `SELECT password FROM users WHERE username=\'admin\';` and compare with `5f4dcc3b5aa765d61d8327deb882cf99`'}, {'type': 'list_item', 'content': 'Attempt to login using the default credentials (admin/password) via HTTP POST to verify if the instance is vulnerable.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Override the default SYSTEM_ADMIN_PASSWORD environment variable with a strong, random password before deployment.
• Modify the installation process to generate and use a secure random admin password if the default or empty password is detected.
• Implement a forced password change on first admin login to prevent continued use of weak or default passwords.
• Add pre-flight checks in the Docker entrypoint script to refuse to start the container if insecure defaults are detected.
• Review and update database credentials from the default trivial values (avideo/avideo) to secure ones.

These steps are part of the recommended remediation and have been implemented in the fix for this vulnerability.

Useful 0 Not Useful 0