Unauthenticated SSRF in AVideo via HTTP Host Header

Executive Summary

AVideo through version 29.0 has an unauthenticated server-side request forgery (SSRF) vulnerability in the check_site_availability function. This flaw allows attackers to manipulate HTTP Host headers in requests to submitIndex.php or ajax.php. By sending arbitrary Host headers, attackers can probe internal network hosts and ports without needing authentication. The system also follows redirects during these requests, which could expose internal services.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual HTTP requests to submitIndex.php or ajax.php with arbitrary Host headers. Check server logs for requests probing internal hosts or ports. Use tools like tcpdump or Wireshark to capture and analyze HTTP traffic for suspicious Host header values.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to scan and map your internal network, identify vulnerable services, or access sensitive internal resources. Since no authentication is required, any exposed internal service could be targeted. Attackers might exploit this to steal data, pivot to other systems, or disrupt internal operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR due to unauthorized data exposure or access. For HIPAA, it may violate safeguards for protected health information if internal systems are compromised. Organizations could face fines or penalties for failing to protect sensitive data under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to the latest version if available. Configure your web server to reject or sanitize arbitrary Host headers. Implement network-level restrictions to block unauthorized internal host probing. Review and restrict access to submitIndex.php and ajax.php endpoints.

Useful 0 Not Useful 0