Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-33648 is a high-severity OS command injection vulnerability in the WWBN AVideo platform affecting versions up to and including 26.0. The vulnerability exists in the restreamer endpoint, which constructs a log file path by embedding user-controlled values `users_id` and `liveTransmitionHistory_id` from the JSON request body without any sanitization.'}, {'type': 'paragraph', 'content': "This unsanitized log file path is then concatenated directly into shell commands executed via PHP's exec() function. Because the input is not sanitized, an authenticated user can inject arbitrary shell commands using shell metacharacters such as `$()` or backticks, leading to arbitrary command execution on the server."}, {'type': 'paragraph', 'content': 'The vulnerability arises because while some inputs like stream URLs are sanitized, the log file path components are not, allowing injection through the log file name. A patch was introduced that sanitizes these inputs and escapes shell arguments to prevent this injection.'}] [2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated user with live streaming permissions to execute arbitrary operating system commands on the server hosting the AVideo platform.

• Full server compromise, including reading sensitive files such as /etc/passwd, database credentials, and configuration files.
• Data exfiltration by accessing the AVideo database and user data.
• Lateral movement within the network, potentially compromising other systems.
• Service disruption by killing processes or modifying/deleting files.
• Establishing persistent backdoors such as installing web shells or cron jobs.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious command execution or unusual files created by injected commands on the server. Since the exploit involves injecting shell metacharacters into the log file path, one way to detect it is to look for log files or processes with unexpected names containing shell metacharacters such as $() or backticks.

You can check for suspicious files created by command injection by listing files in the log directory with unusual characters or timestamps matching attack attempts.

• Use commands like `ls -l /var/www/tmp/` to look for unexpected log files with suspicious names.
• Check for unexpected files created by injected commands, e.g., `ls -l /tmp/pwned` as shown in the proof of concept.
• Monitor running processes for suspicious ffmpeg commands or shell commands spawned by the web server user.
• Review web server logs and application logs for unusual POST requests to the restreamer endpoint containing suspicious characters in `users_id` or `liveTransmitionHistory_id`.

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'Immediate mitigation steps involve sanitizing user inputs and safely escaping shell arguments before execution.'}, {'type': 'list_item', 'content': 'Sanitize the `users_id` and `liveTransmitionHistory_id` values immediately after decoding the JSON input by removing unsafe characters and converting IDs to integers.'}, {'type': 'list_item', 'content': "Apply input sanitization such as: `if (isset($robj->users_id)) { $robj->users_id = preg_replace('/[^a-zA-Z0-9_-]/', '', $robj->users_id); }` and `if (isset($robj->liveTransmitionHistory_id)) { $robj->liveTransmitionHistory_id = intval($robj->liveTransmitionHistory_id); }`."}, {'type': 'list_item', 'content': 'Use `escapeshellarg()` on the log file path before passing it to shell commands to prevent command injection.'}, {'type': 'list_item', 'content': 'Update the code to use the patched version which includes the `sanitizeLogFileComponent` function and applies `escapeshellarg()` to log file paths as shown in the commit fixing this vulnerability.'}, {'type': 'paragraph', 'content': 'These steps prevent injection of malicious shell metacharacters and protect the server from arbitrary command execution.'}] [1, 2]

Useful 0 Not Useful 0