PT-2026-37300 · Avideo · Avideo
Snailsploit
·
Published
2026-05-05
·
Updated
2026-05-29
·
CVE-2026-43884
CVSS v3.1
7.7
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
AVideo versions prior to 29.0
Description
Two endpoints, 'plugin/AI/receiveAsync.json.php' and 'objects/EpgParser.php', use the
isSSRFSafeURL() function to validate user-supplied URLs but then fetch them using file get contents() without disabling automatic redirect following. This allows an attacker to provide a URL that redirects to an internal or cloud-metadata address (such as 'http://169.254.169.254/latest/meta-data/'), bypassing SSRF protections because only the initial URL is validated. This can lead to the exfiltration of IAM credentials, instance identity, or access to internal services and port scanning.Additionally, several callers of
isSSRFSafeURL() discard the $resolvedIP parameter intended for DNS pinning, making them susceptible to DNS rebinding TOCTOU (Time-of-Check to Time-of-Use) attacks. This occurs when a domain's DNS record changes between the time of validation and the time of the actual request. Affected callers include:- 'objects/aVideoEncoderReceiveImage.json.php'
- 'objects/aVideoEncoder.json.php'
- 'plugin/BulkEmbed/save.json.php'
- 'plugin/AI/receiveAsync.json.php'
- 'objects/EpgParser.php'
- 'plugin/Scheduler/Scheduler.php'
Recommendations
Update AVideo to a version later than 29.0.
As a temporary workaround, restrict access to the 'plugin/AI/receiveAsync.json.php' and 'objects/EpgParser.php' endpoints to minimize the risk of redirect-based SSRF.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Avideo