Cross-Site Request Forgery and Path Traversal in AVideo

Executive Summary

This vulnerability is a combination of cross-site request forgery (CSRF) and path traversal in AVideo's stopLive.php file. Attackers can exploit missing token validation and unsanitized key parameter concatenation to delete directories. By crafting an image tag with a traversal payload like key=../../videos, an attacker can trigger recursive deletion of the videos directory when an admin visits a malicious page.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious requests to stopLive.php with path traversal payloads like key=../../videos. Monitor logs for repeated directory deletion attempts or unauthorized file operations in the videos directory. Review network traffic for image tags loading malicious pages.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to delete directories on your system without needing admin credentials beyond a session cookie. If an admin visits a malicious page, it could lead to data loss, including deletion of important files like videos. The attack combines CSRF and path traversal, making it particularly dangerous as it requires minimal user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data deletion, which may violate compliance requirements under GDPR (data integrity and availability) and HIPAA (integrity and availability of protected health information). Loss of critical data could result in regulatory penalties, legal liabilities, and reputational damage due to non-compliance with data protection standards.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest patch if available. Add CSRF token validation and enforce POST requests in stopLive.php. Sanitize the 'key' parameter to prevent path traversal. Restrict access to admin pages and monitor for unauthorized deletions.

Useful 0 Not Useful 0