Server-Side Request Forgery in AVideo API

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in WWBN AVideo affecting the set_api_userImages API endpoint. The flaw allows authenticated API clients to supply internal URLs in profileImg or backgroundImg parameters without proper validation. The application fetches these URLs directly via file_get_contents() and writes responses to publicly accessible web paths, enabling unauthorized access to internal resources like cloud metadata.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF vulnerability in AVideo, monitor network traffic for outbound requests from the AVideo server to internal IP ranges like 169.254.169.254 or private addresses. Check web server logs for unusual file writes to public paths. Use commands like curl to test if the set_api_userImages endpoint accepts internal URLs without validation.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive internal data such as cloud metadata (e.g., AWS IAM credentials), scan internal networks, or access unauthorized services. Since responses are stored in public paths, attackers can retrieve the fetched data remotely. The vulnerability requires API access but the secret is easily obtainable by clients.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding sensitive information. Unauthorized access to internal resources may result in data breaches, triggering compliance violations and potential legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to a patched version that includes isSSRFSafeURL() checks before fetching URLs. Disable the set_api_userImages API endpoint if not required. Restrict network access to internal services and monitor for unauthorized file writes to public web paths.

Useful 0 Not Useful 0