Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the _json_decode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php to read local files or access internal services, with results parsed as login credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-11T12:16:53.803Z",
  "pubdate": "2026-09-11T12:16:53.803Z",
  "executiveSummary": "WWBN AVideo, up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, is susceptible to a critical Server-Side Request Forgery (SSRF) vulnerability. The flaw resides within the _json_decode function, which insecurely processes user-supplied input to fetch both remote URLs and local file system paths.\nThis vulnerability allows unauthenticated remote attackers to perform unauthorized requests by submitting crafted payloads to the login.json.php endpoint. By leveraging this SSRF, an adversary can bypass network security controls to access internal network resources or perform local file inclusion (LFI) to read sensitive system files.\nThe primary risk implication is the exposure of internal server metadata, configuration files, and private services that are not intended for public access. Because the application parses the results of these requests as login credentials, the vulnerability may also be leveraged to facilitate authentication bypass or credential harvesting.\nNo specific authentication or special privileges are required for exploitation, making this a high-severity entry point for attackers to gain unauthorized information and potentially escalate access within the server environment.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of input validation within the _json_decode function in WWBN AVideo. The application fails to sanitize or validate the protocol and destination of user-supplied input before passing it to internal data-fetching mechanisms.\nSpecifically, the application accepts input that is intended for remote resource retrieval but does not enforce a whitelist of allowed domains or protocols. Consequently, the underlying system can be forced to initiate outbound requests to arbitrary HTTP/HTTPS endpoints or interact with the local file system using file:// or similar URI schemes.\nThe exploitation flow begins when an attacker sends a crafted POST request to login.json.php. The target application passes the attacker-controlled parameter to the vulnerable _json_decode function. If the attacker provides a local path (e.g., /etc/passwd or application configuration files), the application attempts to read the file contents as if it were a remote resource. If a remote URL is provided, the server performs a request on behalf of the attacker, effectively functioning as a proxy.\nBecause the function is designed to interpret these retrieved resources as login credentials, an attacker can manipulate the response format to potentially influence the application's authentication logic. In scenarios involving internal service discovery, an attacker can probe for services listening on 'localhost' or within the internal network infrastructure that would otherwise be shielded by a firewall. This enables port scanning and the interaction with internal APIs, databases, or management interfaces.\nThe vulnerability is present in the codebase up to commit c3edcc274c389816d434acadac07ee78eaf330c1. The lack of validation on these requests means that any unauthenticated actor with network visibility to the AVideo instance can trigger the malicious behavior without requiring valid credentials. The post-exploitation impact includes the potential for full system information disclosure, internal network reconnaissance, and the risk of credential exposure through the application’s erroneous processing of fetched data as login attempts."
}