Path Traversal in WWBN AVideo API

Executive Summary

WWBN AVideo has a path traversal flaw in the get_api_login_code API endpoint. Unauthenticated attackers can delete arbitrary .log files by inserting directory traversal sequences in the code parameter. This allows them to remove audit logs and check for file existence on the server.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual file deletion activity in .log files or unexpected API requests to the get_api_login_code endpoint. Check server logs for directory traversal patterns like '../' in the code parameter. Use network traffic analysis tools to inspect HTTP requests targeting this endpoint for suspicious input.

Useful 0 Not Useful 0

Impact Analysis

Attackers could delete critical log files, erasing evidence of their activities or other system events. They might also probe your filesystem to identify sensitive files or weaknesses, potentially leading to further attacks or data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate secure logging and audit trails, such as GDPR's accountability principle or HIPAA's integrity and availability rules. Deleting logs may hinder investigations and reporting, risking non-compliance penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to the latest patched version. Restrict access to the get_api_login_code endpoint by implementing authentication and input validation. Disable directory traversal by sanitizing the code parameter to prevent path manipulation. Review and restore any deleted .log files from backups.

Useful 0 Not Useful 0