Executive Summary

This vulnerability exists in WWBN AVideo, an open source video platform, in versions up to and including 29.0. An authenticated user can set their own donation-notification webhook URL to point to internal, loopback, or metadata hosts such as 127.0.0.1 or 169.254.169.254. When another user makes a donation, the server sends a POST request to the attacker-supplied URL, resulting in a blind Server-Side Request Forgery (SSRF). The URL validation only checks the format and does not properly restrict unsafe URLs. Additionally, the server follows HTTP redirects without revalidation, which can be exploited to redirect requests to internal targets.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to make the AVideo server send unauthorized requests to internal or protected network resources. This could lead to information disclosure from internal services, unauthorized access to metadata endpoints, or other internal systems that are normally inaccessible from outside. The attacker can exploit this SSRF to gather sensitive information or potentially escalate attacks within the internal network.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade WWBN AVideo to a version later than 29.0 where the issue is fixed (commit aaacd48f29f1ff71d1eb5fc81d37605f593cefa9).

Additionally, restrict or validate user-configured webhook URLs more strictly to prevent pointing to internal or loopback addresses.

Disable or carefully control CURLOPT_FOLLOWLOCATION to prevent HTTP redirects from bypassing URL validation.

Useful 0 Not Useful 0