Executive Summary

The vulnerability exists in WWBN AVideo, an open source video platform, specifically in versions 26.0 and prior. It involves the EPG (Electronic Program Guide) link feature, which allows authenticated users with upload permissions to store arbitrary URLs. These URLs are fetched by the server every time the EPG page is visited.

The URL validation uses PHP's FILTER_VALIDATE_URL, which does not prevent internal network addresses from being used. Although there is a function designed to prevent server-side request forgery (SSRF) called isSSRFSafeURL(), it is not applied in this part of the code.

As a result, this leads to a stored SSRF vulnerability, allowing attackers to make the server send requests to internal networks, access cloud metadata services, or interact with internal services.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited to scan internal networks, potentially revealing sensitive internal infrastructure details.

Attackers can access cloud metadata services, which may expose sensitive information such as credentials or configuration data.

It also allows interaction with internal services that are normally not accessible from outside, increasing the risk of further compromise.

Useful 0 Not Useful 0

Mitigation Strategies

Since there are no publicly available patches at the time of publication, immediate mitigation steps include restricting upload permissions to trusted users only and monitoring or disabling the EPG link feature to prevent storage of arbitrary URLs.

Additionally, reviewing and modifying the code to ensure the isSSRFSafeURL() function is called before fetching URLs can help prevent server-side request forgery.

Useful 0 Not Useful 0