Stored XSS in AVideo LoginControl Plugin

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the AVideo software's LoginControl plugin. An authenticated attacker can inject malicious JavaScript by submitting a crafted PGP public key containing an XSS payload. The key is stored without proper sanitization and executes when an administrator views the user's profile tab due to lack of HTML encoding in a textarea element.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect AVideo installations for the LoginControl plugin. Check if PGP public keys are stored without HTML encoding in textarea elements. Review user profiles for malicious scripts in PGP key fields. Monitor administrator sessions for unexpected script execution when viewing profiles.

Useful 0 Not Useful 0

Impact Analysis

An attacker could execute arbitrary scripts in an administrator's session, potentially leading to session hijacking, unauthorized actions, or further compromise of the system. The attack requires the LoginControl plugin to be enabled, attacker login access, and administrator interaction by viewing the profile tab.

Useful 0 Not Useful 0

Mitigation Strategies

Apply htmlspecialchars() to PGP public keys before displaying them in textarea elements. Validate PGP key formats during storage to prevent malicious payloads. Disable the LoginControl plugin if not required. Update to the latest commit (c3edcc274c389816d434acadac07ee78eaf330c1) if available.

Useful 0 Not Useful 0