Blind SSRF in AVideo via getHeaderContentTypeFromURL

Executive Summary

This is a blind Server-Side Request Forgery (SSRF) vulnerability in AVideo versions up to 29.0. It exists in the getHeaderContentTypeFromURL function which uses get_headers() calls protected only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links. When videos are watched, the function executes and probes internal hosts using content-type oracles and timing-based detection.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for outbound requests from your AVideo server to internal or unexpected hosts. Check server logs for repeated get_headers() calls to URLs with attacker-controlled content. Use tools like tcpdump or Wireshark to capture outbound connections from the AVideo process.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to probe internal hosts, services, or cloud metadata by tricking the server into making requests to restricted addresses. While no response body exfiltration is possible, timing and content-type responses may reveal internal network information. Requires only low privileges (canUpload permission) and network access.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could lead to unauthorized network reconnaissance, potentially exposing internal systems or sensitive data. Such breaches may violate data protection principles under GDPR and HIPAA, which require safeguarding personal and health information. Organizations may face compliance penalties if this vulnerability leads to data exposure or unauthorized access.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to the latest patched version of AVideo if available. If no patch exists, restrict the canUpload permission to trusted users only. Implement network-level controls to block outbound requests from the AVideo server to internal or RFC1918 address ranges.

Useful 0 Not Useful 0