Executive brief
AVideo's CloneSite plugin allows administrators to configure site cloning settings, including stored SSH credentials. A vulnerability in password handling combined with weak CSRF protection allows an unauthenticated attacker to trick an authenticated admin into storing a malicious SSH password. When the plugin's scheduled cron job runs, the injected command executes with the privileges of the cron owner, potentially compromising the entire server.
Technical details
The CloneSite plugin suffers from stored OS command injection in cloneClient.json.php where a stored SSH password is directly substituted into an rsync command via str_replace() without shell escaping, allowing a single quote in the password to break out and inject arbitrary shell commands. The password is persisted through the admin-only endpoint objects/pluginAddDataObject.json.php, which relies on a flawed CSRF defense (isUntrustedRequest()/forbidIfIsUntrustedRequest()) that fails when the request appears to come from loopback (behind a same-host reverse proxy with unset trustedProxies) or from a co-hosted attacker-controlled application. HTTPS session cookies are issued with SameSite=None, enabling cross-site request forgery. An unauthenticated attacker can lure an authenticated administrator into storing a malicious password via CSRF, after which the documented crontab entry executes the injected command with the cron owner's privileges (typically root or www-data). This is a residual issue from CVE-2026-41304. No patched version is currently available.
Affected products
- AVideo AVideo through 29.0
Timeline
- 2026-09-16: disclosed