Authentication Bypass in AVideo via menuItems.json.php

Executive Summary

This vulnerability in WWBN AVideo allows unauthenticated attackers to read inactive admin menu items by sending a POST request with a menuId parameter to the plugin/TopMenu/menuItems.json.php endpoint. Attackers can access hidden URLs and secret query parameters that are not visible in the public navigation bar.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the plugin/TopMenu/menuItems.json.php endpoint is accessible without authentication. Send a POST request with a menuId parameter to the endpoint and verify if it returns inactive admin menu items or hidden URLs. Example using curl: curl -X POST -d 'menuId=1' http://target/plugin/TopMenu/menuItems.json.php

Ensure the endpoint only processes POST requests and does not respond to GET requests with sensitive data. Monitor server logs for unauthorized access attempts to this specific path.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to retrieve sensitive admin tool URLs and secret parameters, potentially leading to unauthorized access to administrative functions or further exploitation of the system. This could compromise the integrity and confidentiality of the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of admin URLs and secret parameters may result in non-compliance with data protection and security controls mandated by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable the TopMenu plugin if not required. Restrict access to the plugin/TopMenu/menuItems.json.php endpoint by implementing proper authentication and authorization checks.

Update AVideo to the latest version once a patch is released. Monitor for any suspicious activity or unauthorized access to admin menu items or hidden URLs.

Useful 0 Not Useful 0