Executive Summary

This vulnerability affects WWBN AVideo, an open source video platform, in versions up to and including 29.0. The issue arises because the server-side mitigation for a code execution vulnerability (YPTSocket autoEvalCodeOnHTML eval sink) only removes malicious payloads when they are located under a specific JSON field ($json['msg']). However, the relay function msgToResourceId() selects messages from a different JSON field ($msg['json']) before $msg['msg'].

An unauthenticated attacker can obtain a WebSocket token, connect to the WebSocket server, and send a message with malicious code nested under the top-level json field. Because the stripping of the payload is skipped in this case, the malicious payload is delivered verbatim to any logged-in user identified by to_users_id, and the client script executes it using eval(), leading to remote code execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated attacker to execute arbitrary code on the client side of any logged-in user by sending specially crafted messages through the WebSocket connection. This can lead to compromise of user accounts, unauthorized actions performed on behalf of users, data theft, or further exploitation of the system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update WWBN AVideo to a version that includes the fix from commit 9f3006f9a89a34daa67a83c6ad35f450cb91fcce, which corrects the server-side mitigation for the YPTSocket autoEvalCodeOnHTML eval sink.

Useful 0 Not Useful 0