AVideo-Encoder: unauthenticated full-response server-side request forgery

Overview

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, url_get_contents in objects/functions.php accepts caller-controlled destinations after only FILTER_VALIDATE_URL syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer verification. Login::isLogged reauthenticates using the attacker-settable encoder_aVideoURL cookie together with arbitrary nonempty encoder_user and encoder_pass cookies, and Login::run stores the raw fetched body in result. The unauthenticated objects/login.json.php endpoint returns that session object, enabling full-response exfiltration through a supplied siteURL; its Streamer::isURLAllowed gate allows all sites when the operator allowlist is empty, the default. An unauthenticated remote attacker can read internal HTTP and HTTPS responses, including cloud instance-metadata credentials, and reach internal TCP services. A further pre-authentication FTP variant in view/youtubeDl.json.php routes an ftp videoURL into FTPDownloader; parseFtpUrl in objects/FTPDownloader.php accepts its host and port for ftp_connect. This also enables requests to internal FTP services. Untrusted self-signed HTTPS certificates are accepted, and no account or operator interaction is required. Version 8.1.0 contains an initial remediation attempt that removes raw-response reflection and adds destination checks, but private-network exemptions and login TLS-verification defaults leave complete remediation of the described internal-network and TLS variants unresolved.

Affected

• AVideo-Encoder < 8.1.0

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.