CSRF in AVideo Video Ownership Transfer via Malicious Image Tag

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo where the file objects/videoEditLight.php lacks request authenticity checks and accepts GET requests. Attackers can exploit it by embedding an img tag in a video description that transfers video ownership to their account when an administrator views the page.

Useful 0 Not Useful 0

Detection Guidance

To detect this CSRF vulnerability in WWBN AVideo, inspect the videoEditLight.php file for missing authenticity checks and verify if it accepts GET requests. Check for suspicious img tags in video descriptions that could trigger ownership transfers. Review server logs for unauthorized ownership changes or POST requests to videoEditLight.php.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain control of videos by tricking an administrator into viewing a malicious video page. This could lead to unauthorized changes in video ownership, titles, descriptions, or other metadata without the admin's knowledge.

Useful 0 Not Useful 0

Compliance Impact

This CSRF vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized changes to video ownership and metadata. Under GDPR, unauthorized access or modifications to user-generated content may constitute a breach of integrity and confidentiality requirements. For HIPAA, if the platform handles protected health information in videos, this vulnerability could allow unauthorized alteration or transfer of sensitive data, violating integrity and access control requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to the latest version or apply patches that add request-authenticity checks like forbidIfIsUntrustedRequest() or isGlobalTokenValid() to videoEditLight.php. Ensure the file only accepts POST requests and disable GET request handling. Monitor video ownership changes and restrict admin session access.

Useful 0 Not Useful 0