Compliance Impact

This vulnerability allows an attacker to make cross-origin credentialed requests to API endpoints and read authenticated responses containing user personally identifiable information (PII), email, admin status, and session-sensitive data.

Exposure of such sensitive data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects WWBN AVideo, an open source video platform, in versions 29.0 and below. The issue is due to an incomplete fix for CORS origin validation, where two separate code paths still reflect arbitrary Origin headers with credentials allowed for all /api/* endpoints.

• In plugin/API/router.php (lines 4-8), any origin is unconditionally reflected before application code runs.
• The function allowOrigin(true), called by get.json.php and set.json.php, reflects any origin with Access-Control-Allow-Credentials set to true.

As a result, an attacker can make cross-origin credentialed requests to any API endpoint and read authenticated responses containing sensitive user information such as personally identifiable information (PII), email addresses, admin status, and session-sensitive data.

A fix for this issue is contained in commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to perform cross-origin credentialed requests to the API endpoints of the affected WWBN AVideo platform.

By exploiting this, attackers can read authenticated responses that include sensitive user data such as personally identifiable information (PII), email addresses, admin status, and session-sensitive data.

This can lead to unauthorized disclosure of sensitive information, potential account compromise, and unauthorized administrative access.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update WWBN AVideo to a version that includes the fix from commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13.

This fix addresses the incomplete CORS origin validation that allows arbitrary Origin headers with credentials on all /api/* endpoints.

Useful 0 Not Useful 0