Mitigation Strategies

To mitigate this vulnerability, update WWBN AVideo to a version that includes the fix from commit 603e7bf77a835584387327e35560262feb075db3, which properly handles redirects in the isSSRFSafeURL() validation.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in WWBN AVideo, an open source video platform, in versions up to and including 29.0. Two endpoints (plugin/AI/receiveAsync.json.php and objects/EpgParser.php) validate user-supplied URLs using the function isSSRFSafeURL(), then fetch the URLs using PHP's file_get_contents() without disabling automatic redirect following.

An attacker can supply a URL that points to a server they control, which responds with a 302 redirect to an internal or cloud metadata address (such as http://169.254.169.254/latest/meta-data/). Because isSSRFSafeURL() only validates the initial URL and not the redirect target, the redirect bypasses all SSRF protections, allowing the attacker to access internal resources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to perform Server-Side Request Forgery (SSRF) attacks by bypassing URL validation protections. Specifically, the attacker can trick the server into making requests to internal or cloud metadata services that are normally inaccessible.

Such access can lead to exposure of sensitive internal information, including cloud instance metadata, which may contain credentials or configuration data. This can compromise the confidentiality of your system and potentially lead to further attacks or unauthorized access.

Useful 0 Not Useful 0