Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-33237 is a Server-Side Request Forgery (SSRF) vulnerability in the Scheduler plugin of the WWBN AVideo open source video platform. Prior to version 26.0, the Scheduler plugin's run() function calls a URL configured by an administrator (callbackURL) but only validates the URL format without checking if the URL points to internal or private network addresses."}, {'type': 'paragraph', 'content': 'Unlike other parts of AVideo that were patched for SSRF, the Scheduler plugin did not apply the isSSRFSafeURL() function, which blocks requests to private IP ranges, loopback addresses, and cloud metadata endpoints. This omission allows an admin to configure scheduled tasks with callback URLs targeting internal network resources or cloud infrastructure metadata services, potentially enabling SSRF attacks.'}] [2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have several impacts if exploited by an attacker with administrative access:

• Cloud credential theft: An attacker can retrieve sensitive instance role credentials from cloud metadata services (e.g., AWS, GCP, Azure), which can lead to privilege escalation and broader compromise of cloud infrastructure.
• Internal service probing: The server can be tricked into making requests to internal APIs, microservices, or databases that are not exposed externally, potentially exposing sensitive internal information.
• Exposure of sensitive data: Responses from internal or cloud metadata endpoints are stored in scheduler execution logs, which may leak confidential information.

However, exploitation requires administrative privileges, which limits the attack surface but increases the severity if an admin account is compromised.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring the scheduler execution logs for unexpected HTTP requests to internal or cloud metadata IP addresses, such as 169.254.169.254, which indicate potential SSRF exploitation attempts.'}, {'type': 'paragraph', 'content': 'Specifically, look for log entries containing messages like "Scheduler::run SSRF protection blocked callbackURL: [URL]" or any callback URLs targeting internal network ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) or cloud metadata endpoints.'}, {'type': 'paragraph', 'content': 'Since the vulnerability requires an admin-configured scheduled task with a malicious callbackURL, auditing scheduled tasks for suspicious callback URLs pointing to internal or cloud metadata addresses is recommended.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect suspicious activity include:'}, {'type': 'list_item', 'content': "Use grep or similar tools to search scheduler logs for internal IP addresses or metadata URLs, e.g., `grep -E '169\\.254\\.169\\.254|10\\.|172\\.(1[6-9]|2[0-9]|3[0-1])\\.|192\\.168\\.' /path/to/scheduler/logs`"}, {'type': 'list_item', 'content': 'List scheduled tasks and inspect their callback URLs for internal or metadata IPs.'}, {'type': 'list_item', 'content': 'Monitor network traffic from the server for outbound HTTP requests to internal IP ranges or cloud metadata IPs using tools like tcpdump or Wireshark.'}] [2, 1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade WWBN AVideo to version 26.0 or later, which includes a patch that adds SSRF protection by validating callback URLs with the `isSSRFSafeURL()` function in the Scheduler plugin.

If upgrading immediately is not possible, restrict administrative access to the Scheduler plugin to trusted users only, as exploitation requires admin privileges.

Additionally, audit and remove any scheduled tasks with callback URLs pointing to internal network addresses or cloud metadata services.

Implement network-level controls to block outgoing HTTP requests from the server to internal IP ranges and cloud metadata IP addresses (e.g., 169.254.169.254) to reduce risk.

Useful 0 Not Useful 0