CSRF in AVideo Channel Password Modification

Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in AVideo software. It exists in the setPassword.json.php endpoint and allows unauthenticated attackers to modify any user's channel password by sending a GET request. The endpoint lacks CSRF token validation and POST requirement, enabling attackers to trick an authenticated administrator into visiting a malicious link to change passwords.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your AVideo instance uses the vulnerable setPassword.json.php endpoint. Inspect network traffic for GET requests to /CustomizeUser/setPassword.json.php that modify user passwords without CSRF tokens. Review server logs for suspicious password change requests targeting any user ID.

Useful 0 Not Useful 0

Impact Analysis

An attacker could lock a legitimate user's channel behind a password they control or remove an existing password, gaining unauthorized access. This could lead to account takeover, data theft, or disruption of services if the compromised account has elevated privileges.

Useful 0 Not Useful 0

Compliance Impact

This CSRF vulnerability could lead to unauthorized password changes, potentially allowing attackers to gain control of user accounts. For GDPR, this may violate principles of data protection and user access control. For HIPAA, it could compromise protected health information if user accounts with access to such data are compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to a patched version if available. If no patch exists, implement server-side fixes by adding CSRF token validation and restricting the endpoint to POST requests only. Disable the vulnerable endpoint if not required. Monitor for unauthorized password changes and restrict administrative access.

Useful 0 Not Useful 0