AVideo Information Disclosure via Unauthenticated stats.json.php Access

Executive Summary

AVideo through version 29.0 has an information disclosure vulnerability in the plugin/Live/stats.json.php file. This flaw allows unauthenticated attackers to access stream keys and m3u8 URLs by directly querying the endpoint without any authentication. Attackers can exploit this to enumerate private, unlisted, or group-restricted live streams by parsing the hidden_applications array in the JSON response, which contains sensitive streaming credentials.

Useful 0 Not Useful 0

Detection Guidance

Check if the stats.json.php endpoint is accessible without authentication by using curl commands like 'curl -I http://yourserver/plugin/Live/stats.json.php' or 'curl http://yourserver/plugin/Live/stats.json.php'. If it returns stream keys or m3u8 URLs without requiring login, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to live streams, exposing sensitive streaming credentials. Attackers could intercept or manipulate streams, gain access to private content, or use the exposed m3u8 URLs to download or redistribute streams without permission. It poses risks to privacy, intellectual property, and potential misuse of streaming infrastructure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate data protection regulations like GDPR and HIPAA by exposing sensitive streaming data and credentials. GDPR requires protecting personal data, while HIPAA mandates safeguarding health information. Unauthorized access to streams could lead to breaches, resulting in legal penalties, reputational damage, and loss of user trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the stats.json.php endpoint by implementing authentication or IP whitelisting. Update AVideo to the latest version if a patch is available. Monitor network traffic for unauthorized access attempts to this endpoint.

Useful 0 Not Useful 0