Executive brief
AVideo, an open-source video sharing platform, contains vulnerabilities that allow authenticated users to bypass security filters and access internal network resources. By providing specially crafted web addresses, an attacker can trick the server into connecting to private internal services or cloud metadata providers. This could lead to the theft of sensitive administrative credentials or the exposure of internal data not intended for public access.
Technical details
AVideo's `isSSRFSafeURL()` function is bypassed in multiple components due to improper implementation of fetch logic. First, the `plugin/AI/receiveAsync.json.php` and `objects/EpgParser.php` endpoints use PHP's `file_get_contents()` without disabling automatic redirect following (`follow_location`). An attacker can provide a URL that passes initial validation but redirects to a restricted internal IP (e.g., 169.254.169.254). Second, several callers of `isSSRFSafeURL()` discard the resolved IP out-parameter, failing to perform DNS pinning. This introduces a Time-of-Check Time-of-Use (TOCTOU) race condition exploitable via DNS rebinding (TTL=0), where the second resolution points to a local or private address. Successful exploitation allows internal port scanning and exfiltration of cloud IAM credentials.
Affected products
- WWBN AVideo (formerly YouPHPTube) <= 29.0
Timeline
- 2026-04-27: disclosed: Initial disclosure to vendor
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-11: kev added: NVD publication date