Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-33478 is a critical vulnerability in the WWBN AVideo platform's CloneSite plugin (versions up to and including 26.0). It involves multiple chained flaws that allow a completely unauthenticated attacker to achieve remote code execution."}, {'type': 'paragraph', 'content': 'The vulnerability chain starts with the `clones.json.php` endpoint exposing secret clone keys without any authentication. These keys can be used to trigger a full database dump via the `cloneServer.json.php` endpoint. The dumped database contains admin password hashes stored as unsalted MD5 hashes, which are trivial to crack.'}, {'type': 'paragraph', 'content': 'After cracking the admin passwords, the attacker can log in as an admin and exploit an OS command injection vulnerability in the `cloneClient.json.php` file. This occurs because the rsync command is constructed using unsanitized input from the clone server, allowing arbitrary system commands to be executed as the web server user.'}] [2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to complete server compromise without any user interaction or privileges required.

• An unauthenticated attacker can remotely execute arbitrary system commands on the server.
• The entire database, including sensitive user credentials, videos, configurations, and secrets, can be fully disclosed.
• Admin password hashes stored as unsalted MD5 are trivially crackable, enabling attackers to gain admin access.
• Attackers can perform lateral movement using stolen database and SSH credentials.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking for unauthorized access to the `plugin/CloneSite/clones.json.php` endpoint, which exposes clone secret keys without authentication.'}, {'type': 'paragraph', 'content': 'You can monitor web server logs for unauthenticated requests to `clones.json.php` or `cloneServer.json.php` endpoints.'}, {'type': 'paragraph', 'content': 'Additionally, look for suspicious execution of `mysqldump` commands or unexpected SQL dump files in web-accessible directories.'}, {'type': 'paragraph', 'content': 'Commands to help detect exploitation attempts might include:'}, {'type': 'list_item', 'content': "Check web server access logs for requests to vulnerable endpoints: `grep 'clones.json.php' /var/log/apache2/access.log` or `grep 'cloneServer.json.php' /var/log/apache2/access.log`"}, {'type': 'list_item', 'content': "Search for recently created SQL dump files in web directories: `find /var/www/html -name '*.sql' -mtime -7`"}, {'type': 'list_item', 'content': 'Look for running or recently executed `mysqldump` processes: `ps aux | grep mysqldump`'}, {'type': 'list_item', 'content': 'Check for suspicious rsync commands or shell command injection attempts in logs or process lists.'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'Immediate mitigation steps include restricting access to the `clones.json.php` endpoint to admin users only, preventing unauthenticated disclosure of clone keys.'}, {'type': 'paragraph', 'content': 'Avoid storing SQL dump files in web-accessible directories or require authentication to download them.'}, {'type': 'paragraph', 'content': 'Sanitize all inputs used in shell commands, especially the `videosDir` field and SSH parameters, to prevent command injection.'}, {'type': 'paragraph', 'content': 'Upgrade to the patched version of AVideo where the vulnerability is fixed by input sanitization and access control enforcement (commit c85d076375fab095a14170df7ddb27058134d38c).'}, {'type': 'paragraph', 'content': "Replace insecure MD5 password hashing with stronger algorithms like bcrypt or Argon2 using PHP's `password_hash()` function."}] [1, 2]

Useful 0 Not Useful 0