Authentication Bypass in AVideo via Video Hash Exploitation

Executive Summary

This vulnerability is an authentication bypass in AVideo that allows attackers to gain unauthorized access to another user's account, including administrator privileges. The flaw occurs in two functions: deduplicateByEncoderQueueId() returns a video's credentials (video_id_hash) without verifying ownership, and useVideoHashOrLogin() treats this hash as a passwordless login credential. Attackers with upload permissions can retrieve an administrator's video_id_hash and use it to log in as that user without credentials.

Useful 0 Not Useful 0

Detection Guidance

Check AVideo logs for unusual requests to deduplicateByEncoderQueueId() or useVideoHashOrLogin() functions. Inspect database queries for missing ownership verification in encoder_queue_id lookups. Monitor for unauthenticated sessions using video_id_hash as credentials.

Useful 0 Not Useful 0

Impact Analysis

If you use AVideo with upload permissions, an attacker could exploit this to gain full administrative access to your system. They could modify configurations, access sensitive user data, and manage plugins. Even without direct access, if an administrator's video exists on the platform, an attacker could take over their account and perform actions on their behalf.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Unauthorized modifications to system configurations could also breach compliance with data integrity and access control mandates in these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update AVideo to the latest commit beyond 9c39d8c8. Remove upload permissions from self-registered accounts. Add authorization checks in deduplicateByEncoderQueueId() to verify video ownership. Disable passwordless login via video_id_hash until fixed.

Useful 0 Not Useful 0