Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage() function that inserts the raw Referer header into a JavaScript comment without encoding. Attackers can craft a Referer header containing */ to close the comment and inject arbitrary JavaScript that executes in the site origin for visitors arriving from the attacker-controlled page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-11T12:16:53.327Z",
  "pubdate": "2026-09-11T12:16:53.327Z",
  "executiveSummary": "WWBN AVideo contains a reflected Cross-Site Scripting (XSS) vulnerability residing in the showAlertMessage() function. The flaw is triggered by the improper handling of the HTTP Referer header, which is embedded directly into a JavaScript comment block without appropriate sanitization or context-aware encoding. This vulnerability allows an unauthenticated remote attacker to execute arbitrary JavaScript within the security context of the victim's session.\nThe primary risk involves the compromise of user sessions, potential data theft, and unauthorized actions performed on behalf of the user. By crafting a malicious Referer header, an attacker can break out of the intended comment structure and inject executable code that the browser interprets as legitimate script. This vulnerability poses a significant risk to web application integrity and user privacy. Successful exploitation requires the victim to navigate to the application from an attacker-controlled origin, where the malicious Referer header is sent as part of the initial request. Because the application blindly trusts the HTTP Referer header, it facilitates a persistent attack vector that bypasses basic client-side security measures.",
  "technicalDetails": "The vulnerability is located in the showAlertMessage() function within the WWBN AVideo codebase, affecting versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1. The root cause is the unsafe reflection of the HTTP Referer header into a client-side JavaScript comment block. In web development, comments are generally ignored by the interpreter; however, if an attacker can inject sequence characters that close the comment, the subsequent input is rendered as active JavaScript code.\nExploitation proceeds via the following attack flow: An attacker hosts a malicious page or a redirector that sets a specific HTTP Referer header. When a user clicks a link from the attacker's site to the vulnerable AVideo instance, the browser sends the malicious Referer string in the HTTP request headers. The AVideo application intercepts this header and passes it into the showAlertMessage() function. Inside this function, the application constructs a JavaScript snippet intended to display a message to the user, typically formatted as: /* [Referer] */. By setting the Referer header to a value such as '*/alert(document.domain);/*', the attacker successfully terminates the comment block prematurely.\nThe browser's JavaScript engine receives the resulting source code: /* */alert(document.domain);/* */. Consequently, the injected payload 'alert(document.domain);' is executed immediately in the origin of the vulnerable AVideo site. Because this occurs within the site's own origin, the injected script gains access to sensitive data such as document.cookie, localStorage, and session tokens, effectively bypassing the Same-Origin Policy (SOP).\nThis vulnerability is classified as reflected XSS because the payload is not stored on the server but is instead reflected back to the client via the HTTP request header. The impact is critical, as it allows for full session hijacking, defacement, and the execution of arbitrary actions on behalf of the victim user. No authentication is required to initiate the attack, as the server processes the Referer header before any session validation occurs. The exposure is global, affecting any instance of the application that relies on the vulnerable showAlertMessage() implementation."
}