AVideo-Encoder: unauthenticated full-response server-side request forgery

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, url_get_contents in objects/functions.php accepts caller-controlled destinations after only FILTER_VALIDATE_URL syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer verification. Login::isLogged reauthenticates using the attacker-settable encoder_aVideoURL cookie together with arbitrary nonempty encoder_user and encoder_pass cookies, and Login::run stores the raw fetched body in result. The unauthenticated objects/login.json.php endpoint returns that session object, enabling full-response exfiltration through a supplied siteURL; its Streamer::isURLAllowed gate allows all sites when the operator allowlist is empty, the default. An unauthenticated remote attacker can read internal HTTP and HTTPS responses, including cloud instance-metadata credentials, and reach internal TCP services. A further pre-authentication FTP variant in view/youtubeDl.json.php routes an ftp videoURL into FTPDownloader; parseFtpUrl in objects/FTPDownloader.php accepts its host and port for ftp_connect. This also enables requests to internal FTP services. Untrusted self-signed HTTPS certificates are accepted, and no account or operator interaction is required. Version 8.1.0 contains an initial remediation attempt that removes raw-response reflection and adds destination checks, but private-network exemptions and login TLS-verification defaults leave complete remediation of the described internal-network and TLS variants unresolved.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ncoder/security/advisories/GHSA-cvhm-j9cp-8w59 Diğer
• github.com/…ommit/60430ee18f669798485e81276a1fb6d26b06eb9a Diğer
• github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0 Diğer

Kayıt geçmişi

1. 29 Eki 2026 00:47Yayımlandı

İlgili açıklar

• 4,7 CVE-2026-61575AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles
• 7,5 CVE-2026-61569AVideo-Encoder: pre-authentication streamer-login SQL injection
• 7,3 CVE-2026-61571AVideo-Encoder: missing authentication on control and status endpoints
• 6,1 CVE-2026-61573AVideo-Encoder: reflected cross-site scripting in the login interface
• 10,0 CVE-2026-61567AVideo-Encoder: unauthenticated command execution through streamer login trust
• 10,0 CVE-2026-61564AVideo-Encoder: unauthenticated installer PHP code injection