Description

WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal services, with responses written to publicly accessible web paths for retrieval.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-03T13:06:23.567Z",
  "pubdate": "2026-09-03T13:06:23.567Z",
  "executiveSummary": "WWBN AVideo contains a critical Server-Side Request Forgery (SSRF) vulnerability within the set_api_userImages API endpoint. This flaw allows an authenticated attacker to force the application to initiate unauthorized HTTP requests to arbitrary destinations.\nBy manipulating the profileImg and backgroundImg URL parameters, an attacker can perform internal reconnaissance, interact with cloud metadata services (e.g., AWS/GCP/Azure instance metadata), or probe internal network resources that are otherwise inaccessible from the public internet.\nThe vulnerability is exacerbated by the application's behavior of writing the fetched content to publicly accessible web paths, effectively creating a mechanism for data exfiltration. Successful exploitation allows an authenticated user to bypass network segmentation and extract sensitive information from the internal infrastructure.\nThe risk profile is significant, as the impact ranges from information disclosure to potential full server compromise depending on the reachable internal environment and the sensitivity of the data retrieved.",
  "technicalDetails": "The vulnerability resides in the set_api_userImages API endpoint, which fails to implement adequate input validation or server-side sanitization on the profileImg and backgroundImg parameters. The affected component is responsible for retrieving and caching image resources provided by the user via URL.\nThe root cause is an improper trust boundary enforcement. The application logic trusts the user-supplied input to represent legitimate image sources without verifying if the destination URL points to an external resource or an internal/local resource.\nAttack flow: An authenticated user transmits a specially crafted request to the set_api_userImages endpoint. The attacker substitutes standard image URLs with internal target URLs, such as http://169.254.169.254/latest/meta-data/ for cloud metadata extraction or internal service URLs (e.g., http://localhost:PORT or internal IP addresses). The application processes these inputs and performs a GET request to the supplied target using server-side resources.\nUpon receiving a response from the requested target, the AVideo server caches or saves the returned content—regardless of whether it is an image or sensitive configuration data—into a web-accessible directory. Because the application logic does not validate the content-type or structure of the response before storage, the retrieved data becomes retrievable via a public HTTP request.\nAffected versions include WWBN AVideo through commit c91b5975d. Exploitation requires authenticated access, but the lack of further privilege verification beyond initial authentication means any registered user can trigger the vulnerability. The network exposure is broad, as the server can act as a proxy into the internal network segment where it is hosted. Post-exploitation, an attacker can effectively pivot through the application to interact with internal APIs, databases, or configuration services that rely on IP-based authentication or private network trust."
}