CSRF in WWBN AVideo Live Channel Settings

Executive Summary

This vulnerability is a cross-site request forgery (CSRF) flaw in WWBN AVideo through version 30.0 and master up to commit 4cb576e. The issue is in the plugin/Live/myLiveControls.save.json.php endpoint, which fails to validate CSRF tokens or check request origins. A logged-in streamer can be tricked into visiting a malicious page, which silently modifies live-channel viewer-redirect settings via GET parameters like customUrl, customMessage, and autoRedirect. These changes are saved in users.externalOptions and can persistently redirect viewers to phishing sites or display spoofed messages.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual GET requests to plugin/Live/myLiveControls.save.json.php with parameters like customUrl, customMessage, or autoRedirect. Check server logs for suspicious changes to users.externalOptions or unexpected redirects.

Useful 0 Not Useful 0

Impact Analysis

If you are a streamer using WWBN AVideo, an attacker could exploit this to change your live channel's redirect settings without your knowledge. Viewers of your stream could be redirected to malicious websites or shown fake messages, potentially leading to credential theft or malware infections. The attack requires you to be logged in and tricked into visiting a malicious page, but it can happen silently without further interaction.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to the latest patched version. Disable or restrict access to the vulnerable endpoint if updates are not possible. Implement CSRF tokens and enforce origin checks for all sensitive endpoints.

Useful 0 Not Useful 0