Executive brief
Kaltura is a video management platform used by organizations to host and stream media content. A security flaw in the platform's editor services allows an unauthenticated attacker to take complete control of the web server. This could lead to the theft of sensitive media data, service outages, or the use of the server as a foothold for further attacks on the internal network.
Technical details
A PHP Object Injection vulnerability exists in the 'keditorservices' module of Kaltura. The root cause is the unsafe use of the 'unserialize()' function on user-supplied data provided via the 'kdata' GET parameter at the 'redirectWidgetCmd' endpoint. An unauthenticated remote attacker can exploit this by sending a Base64-encoded, specially crafted serialized PHP object. This triggers a POP (Property Oriented Programming) chain, specifically leveraging the Zend_Log and Zend_Layout classes, to achieve arbitrary PHP code execution in the context of the web server process. The vulnerability is addressed in version 11.1.0-2 and later.
Affected products
- Kaltura Video Platform < 11.1.0-2
Timeline
- 2016-03-15: disclosed: Initial discovery and disclosure by Security-Assessment.com
- 2016-09-21: other: Metasploit module released
- 2025-07-23: advisory: CVE record published/updated