How can this vulnerability impact me? :

This vulnerability can impact you by allowing an attacker to disrupt your live streaming services.

Since unauthenticated users can terminate any active live stream, it can cause denial-of-service conditions, interrupting broadcasts and potentially affecting user experience and service availability.

Useful 0 Not Useful 0

Can you explain this vulnerability to me?

This vulnerability exists in the WWBN AVideo open source video platform, specifically in versions 26.0 and prior. The issue is with the on_publish_done.php endpoint in the Live plugin, which allows unauthenticated users to terminate any active live stream.

The endpoint is designed to process RTMP callback events to mark streams as finished in the database, but it does not perform any authentication or authorization checks before doing so.

An attacker can first enumerate active stream keys using the unauthenticated stats.json.php endpoint, then send crafted POST requests to on_publish_done.php to terminate any live broadcast.

This effectively allows an attacker to cause a denial-of-service against all live streaming functionality on the platform.

Useful 0 Not Useful 0

How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by monitoring for unauthorized POST requests to the on_publish_done.php endpoint in the Live plugin of the WWBN AVideo platform. Since the endpoint allows unauthenticated users to terminate active live streams, unusual or unexpected POST requests to this endpoint may indicate exploitation attempts.

Additionally, enumeration of active stream keys via unauthenticated access to the stats.json.php endpoint can be a sign of reconnaissance activity by an attacker.

Suggested commands to detect such activity include using network monitoring tools or web server logs to filter for POST requests to on_publish_done.php and GET requests to stats.json.php. For example, using grep on web server logs:

• grep 'POST /Live/on_publish_done.php' /var/log/apache2/access.log
• grep 'GET /Live/stats.json.php' /var/log/apache2/access.log

Network traffic analysis tools like tcpdump or Wireshark can also be used to capture and inspect HTTP requests targeting these endpoints.

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation steps include restricting access to the on_publish_done.php and stats.json.php endpoints to trusted users only, for example by implementing authentication or IP-based access controls.

Since there are no publicly available patches at the time of publication, consider disabling the Live plugin or these specific endpoints if live streaming functionality is not critical.

Monitoring for suspicious activity targeting these endpoints and preparing to apply patches or updates once they become available is also recommended.

Useful 0 Not Useful 0