Publish GHSA-x9w5-xccw-5h9w

Author: advisory-database[bot]

advisories/github-reviewed/2026/04/GHSA-x9w5-xccw-5h9w/GHSA-x9w5-xccw-5h9w.json

@@ -0,0 +1,57 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x9w5-xccw-5h9w",
+  "modified": "2026-04-03T23:33:09Z",
+  "published": "2026-04-03T23:33:09Z",
+  "aliases": [
+    "CVE-2026-35179"
+  ],
+  "summary": "AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php",
+  "details": "## Summary\n\nThe SocialMediaPublisher plugin exposes a `publishInstagram.json.php` endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via `InstagramUploader::publishMediaIfIsReady()`. This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.\n\n## Details\n\nAt `plugin/SocialMediaPublisher/publishInstagram.json.php:14`, the endpoint passes request parameters directly to the Instagram Graph API without any authentication check:\n\n```php\nInstagramUploader::publishMediaIfIsReady(\n    $_REQUEST['accessToken'],\n    $_REQUEST['containerId'],\n    $_REQUEST['instagramAccountId']\n);\n```\n\nThere is no call to `User::isLogged()`, `User::isAdmin()`, or any other authorization check before processing the request.\n\nIn contrast, sibling endpoints in the same plugin enforce proper authorization:\n- `uploadVideo.json.php` requires `User::isLogged()`\n- `refresh.json.php` requires `User::isAdmin()`\n\nThe endpoint was confirmed accessible on a live instance: it returns a Graph API error response, demonstrating that it processes the request and forwards it to Facebook's servers.\n\n## Proof of Concept\n\n1. Send a request to the endpoint without any authentication:\n\n```bash\ncurl -s \"https://your-avideo-instance.com/plugin/SocialMediaPublisher/publishInstagram.json.php\" \\\n  -d \"accessToken=TEST_TOKEN&containerId=TEST_CONTAINER&instagramAccountId=TEST_ACCOUNT\"\n```\n\n2. The server forwards the request to the Facebook Graph API. With invalid parameters, it returns a Graph API error confirming the endpoint is functional:\n\n```json\n{\n  \"error\": {\n    \"message\": \"Invalid OAuth access token.\",\n    \"type\": \"OAuthException\",\n    \"code\": 190\n  }\n}\n```\n\n3. With a valid access token (e.g., one leaked from AVI-027), an attacker could publish content to the platform's Instagram account:\n\n```bash\ncurl -s \"https://your-avideo-instance.com/plugin/SocialMediaPublisher/publishInstagram.json.php\" \\\n  -d \"accessToken=LEAKED_ACCESS_TOKEN&containerId=REAL_CONTAINER_ID&instagramAccountId=REAL_ACCOUNT_ID\"\n```\n\n4. Verify that sibling endpoints require authentication:\n\n```bash\n# Should require login\ncurl -s \"https://your-avideo-instance.com/plugin/SocialMediaPublisher/uploadVideo.json.php\"\n\n# Should require admin\ncurl -s \"https://your-avideo-instance.com/plugin/SocialMediaPublisher/refresh.json.php\"\n```\n\n## Impact\n\nThe unauthenticated endpoint allows any attacker to use the AVideo server as a proxy for Instagram/Facebook Graph API calls. When combined with credentials leaked from AVI-027 (unauthenticated access to social media API credentials), an attacker can publish, modify, or delete content on the platform's Instagram account without any authentication to the AVideo instance. The server's IP address is used for the API calls, which could also be used to bypass rate limits or IP-based restrictions on the Graph API.\n\n- **CWE-862**: Missing Authorization\n- **Severity**: Medium\n\n## Recommended Fix\n\nAdd an admin authorization check at the top of `plugin/SocialMediaPublisher/publishInstagram.json.php:10`, consistent with the sibling `refresh.json.php` endpoint:\n\n```php\n// plugin/SocialMediaPublisher/publishInstagram.json.php:10\nif(!User::isAdmin()){\n    die(json_encode(['error'=>'Not authorized']));\n}\n```\n\nThis restricts the endpoint to admin users only, matching the authorization level of `refresh.json.php` and preventing unauthenticated proxy abuse.\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "wwbn/avideo"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "26.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x9w5-xccw-5h9w"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/WWBN/AVideo"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-862"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-04-03T23:33:09Z",
+    "nvd_published_at": null
+  }
+}