Cross-Site Request Forgery in AVideo Playlist Deletion

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo where the playlistRemove.php file lacks proper CSRF protection. Attackers can trick logged-in users into deleting their playlists by submitting a malicious POST request when they visit an attacker-controlled page.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your AVideo installation contains the vulnerable playlistRemove.php file in the objects directory. Verify if the file lacks CSRF protection by checking for the absence of autoCSRFGuard() calls or forbidIfIsUntrustedRequest() functions. Inspect network traffic for POST requests to playlistRemove.php from untrusted sources.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows attackers to delete any playlist owned by a logged-in user without their consent. Users may lose important playlists, and the attack can occur simply by visiting a malicious website while logged into AVideo.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to a version that includes CSRF protection in playlistRemove.php. As a temporary fix, rename the file to playlistRemove.json.php to enable automatic CSRF protection. Alternatively, add forbidIfIsUntrustedRequest() to the file. Monitor for unauthorized playlist deletions and restrict access to sensitive endpoints.

Useful 0 Not Useful 0