Mitigation Strategies

To mitigate this vulnerability, you should update WWBN AVideo to a version that includes the fix, as indicated by commit 764db592f99e545aa86bb9a4ad664ffd14c38ba5.

Avoid using versions up to and including 29.0, as they contain the vulnerable endpoint that allows attacker-controlled injection into ICS calendar files.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in WWBN AVideo, an open source video platform, in versions up to and including 29.0. The issue is in the unauthenticated plugin/Scheduler/downloadICS.php endpoint, which accepts attacker-controlled parameters such as title, description, and joinURL. These parameters are passed into the Scheduler::downloadICS() function that builds an ICS calendar file using the ICS helper class.

The ICS::escape_string() function only escapes commas and semicolons but does not neutralize carriage return and line feed (CR/LF) characters. This allows an attacker to inject CRLF bytes inside a property value, breaking out of the intended field and injecting arbitrary ICS lines, including new calendar event blocks (END:VEVENT / BEGIN:VEVENT).

Because the malicious .ics file is served from the victim's trusted AVideo origin, this enables high-credibility calendar phishing attacks where forged meetings with attacker-chosen details like SUMMARY, URL, LOCATION, and DESCRIPTION appear in the victim's calendar after import.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to calendar phishing attacks by injecting malicious calendar events into a victim's calendar application. Since the malicious .ics files come from a trusted source (the victim's own AVideo platform), the forged events appear credible and can trick users into attending fake meetings or clicking on malicious URLs.

Such phishing events can be used to deliver social engineering attacks, potentially leading to credential theft, malware installation, or other security breaches.

Useful 0 Not Useful 0