Executive brief
AVideo is a video hosting platform that allows authenticated users to upload and manage videos. A vulnerability in the video link processing function allows authenticated users with upload permissions to store malicious URLs that are automatically accessed whenever someone views the video, enabling them to probe internal network hosts and cloud metadata services. An attacker can use timing differences and HTTP response headers to detect internal services without direct network access.
Technical details
The vulnerability is a blind server-side request forgery (SSRF) in the getHeaderContentTypeFromURL() function (objects/functions.php:6113). The function calls get_headers($url, 1) to inspect HTTP headers of remote URLs, but only validates the URL format using isValidURL()—a character blacklist and regex check that accepts arbitrary hosts including IP literals and internal addresses. The vulnerable code path is triggered when Video::getIncludeType() processes video links without the /m3u8/ pattern, calling isHTMLPage() which invokes the unguarded getHeaderContentTypeFromURL(). An authenticated user with canUpload permission can store an attacker-controlled URL as a videoLink, and the vulnerable function executes automatically on each video page render. PHP's default stream context (follow_location=1) also follows 30x redirects to internal hosts. An attacker can extract partial information via content-type oracles (text/html vs. video) and timing-based detection to probe internal/RFC1918/link-local/cloud-metadata hosts. No patched version is currently available.
Affected products
- WWBN AVideo through 29.0
Timeline
- 2026-08-31: disclosed
- 2026-09-15: advisory