Executive brief
AVideo is a video streaming platform that includes a site availability check function. An unauthenticated vulnerability allows attackers to send crafted requests to bypass security checks and probe internal network hosts and services by manipulating the Host header, potentially discovering internal infrastructure and accessible ports without authentication.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the WWBNIndex::check_site_availability() function (plugin/WWBNIndex/WWBNIndex.php:201–223). The function accepts an attacker-controlled HTTP Host header and passes it to curl_init() with FOLLOWLOCATION=true, MAXREDIRS=10, and SSL verification disabled, but lacks SSRF validation. Two entry files (submitIndex.php and ajax.php) evaluate a gate condition that checks $_SERVER['SERVER_NAME'] (server-derived) but then calls check_site_availability($_SERVER['HTTP_HOST']) before any authentication or plugin-enabled checks, allowing unauthenticated attackers to supply arbitrary Host headers. The attack requires network access to submitIndex.php or ajax.php and no authentication; attackers can follow up to 10 redirects into internal scope and use HTTP response codes as an internal reachability oracle. No patches are currently available for versions up to and including 29.0.
Affected products
- WWBN AVideo through 29.0
Timeline
- 2026-08-31: disclosed
- 2026-09-15: advisory