PT-2023-20024 · World Wide Broadcast Network · Avideo

Gonzxph · Published 2023-02-02 · Updated 2023-05-04 · CVE-2023-25313

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions World Wide Broadcast Network AVideo versions prior to 12.4

Description The issue allows attackers to execute arbitrary code via the video link field to the Embed a video link feature. An attacker could execute remote code on a system running wwbn/avideo by appending a command to the URL as a query string, for example, ?whoami, and then clicking Save. This can be done by going to the My Videos tab, clicking "Embed a video link", and then appending the malicious query string.

Recommendations For versions prior to 12.4, update to version 12.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Embed a video link" feature in the My Videos tab until the update is applied. Avoid using the video link field to execute arbitrary commands until the issue is resolved.

Exploit

Fix

OS Command Injection

XSS

Weakness Enumeration

CWE-78

CWE-79

Related Identifiers

CVE-2023-25313

GHSA-PGVH-P3G4-86JW

GHSA-WJ6R-53F5-Q789

Affected Products

Avideo

References · 10

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-pgvh-p3g4-86jw · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-30842 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-25313 · Security Note
• https://osv.dev/vulnerability/GHSA-wj6r-53f5-q789 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pgvh-p3g4-86jw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25313 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/commit/236228f15a9a31be5a0e60f05dac043682e49a5e · Note
• https://t.me/cibsecurity/62817 · Telegram Post
• https://t.me/cvenotify/49814 · Telegram Post