| Package | Affected versions | Patched versions |
|---|---|---|
| WWBN/AVideo | ≤ 26.0 | |
| avideo | ≤ 26.0 |
The Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers.
The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services through the restream log feature.
The vulnerable chain was:
plugin/Live/view/getRestream.json.php exposed a fresh tokenForActionplugin/Live/view/Live_restreams/verifyTokenForAction.json.php exchanged it for a valid responseTokenplugin/Live/view/Live_restreams_logs/add.json.php accepted attacker-controlled restreamerURLplugin/Live/view/getRestream.json.php and plugin/Live/view/Live_restreams/getAction.json.php later fetched that stored URL server-sideThe original issue existed because the responseToken was accepted, but the callback destination was not tightly constrained to trusted restreamer endpoints.
The maintainer confirmed the vulnerability and stated that the fix was applied by validating restreamerURL at storage time and re-validating the log-entry branch before use. The maintainer also noted that the m3u8 field follows the same general pattern but is not server-fetched in the current flow.
plugin/Live/view/Live_restreams/testRestreamer.json.php to create a live transmission history row.GET /plugin/Live/view/getRestream.json.php?live_transmitions_history_id=<id>&restreams_id=<id>
tokenForAction from the returned URL.responseToken via:POST /plugin/Live/view/Live_restreams/verifyTokenForAction.json.php
POST /plugin/Live/view/Live_restreams_logs/add.json.php
restreamerURL=http://127.0.0.1:9999/index.php
getRestream.json.php again.Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeAn authenticated streamer can cause the AVideo server to send HTTP requests to loopback or internal services and return the response through normal application endpoints by storing a malicious restreamerURL in the restream log flow. Because the callback destination was not constrained to trusted restreamer endpoints, the application could be used as a proxy to internal-only services that trust network locality. Successful exploitation can expose local admin panels, internal-only APIs, cloud metadata services if reachable, or other sensitive internal responses available from the application host.
restreamerURL against explicitly configured restreamer endpoints at storage timeresponseToken to the expected restream row and callback host