Description

AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epg_link parameter during video upload, which is validated only for syntax and later fetched server-side during EPG generation without SSRF protection checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-03T13:06:23.423Z",
  "pubdate": "2026-09-03T13:06:23.423Z",
  "executiveSummary": "AVideo, up to commit c91b5975d, is susceptible to a Server-Side Request Forgery (SSRF) vulnerability residing within its Electronic Program Guide (EPG) parsing mechanism. The vulnerability originates from insufficient input sanitization and a lack of request filtering during the server-side retrieval of remote resources provided by the user.\nAn authenticated user with upload privileges can exploit this flaw by submitting a crafted, arbitrary internal URL via the epg_link parameter. Because the application performs only rudimentary syntax validation before initiating a server-side fetch, an attacker can coerce the AVideo server into making unauthorized HTTP requests to internal network services. This capability exposes the internal infrastructure to reconnaissance, interaction with non-public APIs, or the exploitation of internal services that trust requests originating from the local host or the web server. The risk is significant as it effectively bypasses network segmentation and perimeter defenses, granting the attacker a proxy into the trusted environment where the AVideo instance resides.",
  "technicalDetails": "The vulnerability is located in the EPG parser component of AVideo, which is responsible for processing remote EPG data. During the video upload process, the application accepts an epg_link parameter intended to fetch scheduling metadata. The root cause of this SSRF vulnerability is the failure of the application to implement a blocklist or allowlist for internal IP ranges or sensitive URI schemes prior to the request execution phase.\nThe attack flow proceeds as follows: First, an attacker must possess a valid authenticated account with sufficient privileges to upload content, as the vulnerable endpoint is exposed during the video upload process. Second, the attacker interacts with the video submission interface and injects a target internal URL into the epg_link field. Examples of such targets include internal management consoles (e.g., http://127.0.0.1:8080), local metadata services, or sensitive internal administrative endpoints that would otherwise be inaccessible from the public internet.\nUpon receiving the request, the application performs basic syntax validation to ensure the input appears as a valid URI. However, it fails to evaluate the hostname or IP address of the target destination to ensure it does not resolve to the local loopback interface (127.0.0.1/8) or private network ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).\nOnce the initial validation passes, the application logic proceeds to trigger the EPG generation process. During this stage, the server-side component initiates an outbound HTTP request to the attacker-supplied URL. Because this request is executed by the AVideo server process, it originates from a 'trusted' source within the internal network. The server subsequently processes the response from the targeted internal resource. This allows the attacker to perform port scanning of the local host or nearby internal infrastructure, or in some configurations, retrieve sensitive data if the internal resource responds with information that is then reflected back in the AVideo interface or processed by the parser.\nThis vulnerability effectively turns the AVideo server into an internal proxy, enabling the attacker to bypass network-level security controls, probe internal service architectures, and potentially exploit secondary vulnerabilities in internal systems that do not require further authentication."
}