Description

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request /plugin/WebRTC/status.json.php and receive JSON containing the absolute filesystem path of the WebRTC2RTMP helper binary (revealing the document-root path), the configured WebRTC port, file_exists/is_executable status for the binary, the contents of the WebRTC log/JSON files (videos/WebRTC2RTMP.log) when present, and whether the configured port is reachable on loopback (127.0.0.1) and on the public address. The endpoint performs no User::isLogged(), User::isAdmin(), or forbiddenPage() check. The issue was unfixed at the time of reporting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-11T12:16:54.730Z",
  "pubdate": "2026-09-11T12:16:54.730Z",
  "executiveSummary": "AVideo, up to commit c3edcc274c389816d434acadac07ee78eaf330c1, contains an information disclosure vulnerability in the WebRTC plugin.\nThe vulnerability originates from a missing authentication and authorization check within the plugin/WebRTC/status.json.php file.\nThis flaw allows unauthenticated, remote attackers to access sensitive system configuration data and internal server information without valid credentials.\nThe exposure includes absolute filesystem paths, binary execution status, network connectivity metrics, and raw log file contents, facilitating potential reconnaissance and target profiling.\nThe risk is high as the vulnerability is trivial to exploit via direct HTTP GET requests, requiring no prior authorization or specific user interaction.\nBy revealing the application's document root and backend operational state, this exposure significantly lowers the barrier for subsequent, more severe attacks, such as local file inclusion (LFI) or server-side request forgery (SSRF) leveraging the revealed infrastructure paths.",
  "technicalDetails": "The vulnerability resides in the file plugin/WebRTC/status.json.php within the AVideo WebRTC plugin component. The root cause is the total absence of security middleware or conditional checks that typically govern access to sensitive administrative or diagnostic endpoints in the AVideo framework.\nSpecifically, the script fails to invoke internal security functions such as User::isLogged(), User::isAdmin(), or the forbiddenPage() helper. These functions are standard in the AVideo architecture for enforcing session-based access control and privilege validation. Without these checks, the web server executes the script in the context of any incoming HTTP request.\nThe attack flow is straightforward: an unauthenticated remote attacker performs a direct GET request to the URI /plugin/WebRTC/status.json.php. The application responds with a JSON-formatted diagnostic payload that leaks critical infrastructure information. This information includes the absolute system path to the WebRTC2RTMP helper binary, which identifies the server's filesystem layout (document-root).\nFurthermore, the response provides the status of the binary, including boolean checks for file_exists() and is_executable(). It also reveals the contents of internal logs stored at 'videos/WebRTC2RTMP.log', providing the attacker with visibility into server activity, potential errors, and system events. Additionally, the script performs and reports on connectivity tests against the configured WebRTC port, confirming its reachability via the loopback interface (127.0.0.1) and the public-facing network interface.\nThe implications of this disclosure are significant for reconnaissance. Exposure of absolute filesystem paths assists attackers in mapping the target's directory structure, which is a prerequisite for chaining this vulnerability with other potential file-based exploits. Access to the WebRTC2RTMP logs can leak sensitive metadata regarding the platform's media streaming operations, potentially including internal IP addresses, session identifiers, or process statuses.\nBecause the script functions as a diagnostic tool, it provides an attacker with a real-time assessment of the environment without requiring any authentication, privilege escalation, or interaction with an administrative user. The lack of input validation and authentication headers means that any user reachable via the network can harvest this information, compromising the principle of least privilege required for administrative diagnostic endpoints."
}