AVideo hat eine Authentifizierte Server-Seitliche Request Forgery via downloadURL in aVideoEncoder.json.php

The SSRF vulnerability in AVideo’s aVideoEncoder.json.php API endpoint allows an authenticated attacker to bypass security controls and interact with internal services. By manipulating the downloadURL parameter, an attacker can instruct the server to fetch resources from any URL, including internal network endpoints that are not directly accessible from the outside. This could lead to the exposure of sensitive data stored on internal servers, such as configuration files, database credentials, or even proprietary code. The potential for lateral movement within the internal network is significant, as the attacker can use the compromised server as a proxy to scan and exploit other internal systems. The blast radius extends to any internal resource accessible via HTTP or HTTPS from the AVideo server.

Organizations utilizing AVideo versions prior to 22.0, particularly those with internal services accessible via the network, are at risk. Shared hosting environments where multiple users share the same AVideo instance are also particularly vulnerable, as a compromised user account could be leveraged to exploit the SSRF vulnerability.

• php: Examine access logs for requests to aVideoEncoder.json.php with unusual or unexpected downloadURL parameters. Look for URLs pointing to internal IP addresses or non-standard ports.

grep 'aVideoEncoder.json.php' access.log | grep 'downloadURL='

• generic web: Use curl to test the endpoint with a known internal URL and verify that the request is blocked.

curl -v 'http://<avideo_server>/aVideoEncoder.json.php?downloadURL=http://169.254.169.254/mgmt/inventory' 

• generic web: Check response headers for unexpected content types or error messages indicating an internal server error when attempting an SSRF request.

1. 2026-02-25Disclosure

   disclosure

1. Reserviert2026-02-23
2. Veröffentlicht2026-02-25
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-27732 is to upgrade AVideo to version 22.0 or later, which includes the necessary fix. If upgrading immediately is not feasible, implement temporary workarounds to reduce the risk. Deploy a Web Application Firewall (WAF) with rules to block requests containing suspicious URLs or patterns in the downloadURL parameter. Restrict network access to the AVideo server, limiting its ability to connect to internal resources. Implement strict input validation on the downloadURL parameter, enforcing an allow-list of permitted domains or protocols. After upgrading, confirm the fix by attempting to trigger an SSRF request with a known malicious URL and verifying that it is blocked.

Zuletzt aktualisiert

29.0kürzlich