Executive Summary

This vulnerability exists in WWBN AVideo, an open source video platform, in versions up to and including 29.0. The issue is in the plugin/CloneSite/cloneClient.json.php file, which unintentionally exposes the local CloneSite shared secret (myKey) in the HTTP response body on every unauthenticated request. This shared secret is a constant derived from system paths and salts. Although the code was intended to reject unauthorized access, it leaks this secret in the error message before terminating the request.

If the victim has CloneSite configured with a remote cloneSiteURL (a common setup for federation or backup), the leaked myKey acts as a credential that allows an attacker to authenticate to the remote server's cloneServer.json.php. This enables the attacker to impersonate the victim and trigger a full mysqldump of the remote server's database, which is then stored in the remote server's public videos/clones/ directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized disclosure of sensitive data. An attacker can obtain the shared secret key without authentication, allowing them to impersonate the victim on a remote CloneSite server.

By exploiting this, the attacker can trigger a full database dump (mysqldump) of the remote server, exposing potentially sensitive information stored in the database. This data is then publicly accessible in the remote server's videos/clones/ directory, leading to data leakage and potential compromise of user privacy and system integrity.

Useful 0 Not Useful 0