AVideo OS Command Injection via ffmpeg.json.php

Executive Summary

AVideo version 29.0 and earlier has an OS command injection flaw in the ffmpeg.json.php endpoint. The vulnerability occurs because the notifyCode and callback parameters are directly concatenated into a shell command without proper escaping. Attackers who can create a valid encrypted payload can inject shell metacharacters into these parameters to execute arbitrary operating system commands with the privileges of the web server user.

Useful 0 Not Useful 0

Detection Guidance

Check if the AVideo application is running and accessible. Inspect network traffic for requests to the ffmpeg.json.php endpoint with notifyCode or callback parameters containing suspicious shell metacharacters or encrypted payloads.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the server running AVideo. This could lead to full system compromise, data theft, unauthorized access, or disruption of services. If exploited, attackers may gain control over the server, install malware, or exfiltrate sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can severely impact compliance with GDPR, HIPAA, and other regulations. It may result in unauthorized access to personal or sensitive data, leading to data breaches. Organizations could face legal penalties, fines, and reputational damage due to non-compliance with data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update AVideo to the latest version beyond 29.0. Disable or restrict access to the ffmpeg.json.php endpoint if not needed. Implement input validation and sanitization for notifyCode and callback parameters to prevent command injection.

Useful 0 Not Useful 0