WWBN AVideo hat einen SSRF über gleichen Domain-Hostnamen mit alternativen Port-Umgehungen isSSRFSafeURL

The SSRF vulnerability in AVideo allows an attacker to craft requests to arbitrary ports on the AVideo server. This bypass circumvents intended security measures designed to restrict outbound connections. The response body from these crafted requests is then saved to a publicly accessible path, enabling an attacker to exfiltrate sensitive data. This could include configuration files, internal API responses, or any other data accessible to the AVideo server. Successful exploitation could lead to unauthorized access to internal resources and compromise the confidentiality of the system.

Organizations using AVideo in production environments, particularly those with sensitive data or internal services accessible via the web server, are at risk. Shared hosting environments where multiple users share the same AVideo instance are also particularly vulnerable, as an attacker could potentially exploit the vulnerability to access data belonging to other users.

• php: Examine the objects/functions.php file for the isSSRFSafeURL() function and its shortcircuit logic. Look for modifications or unexpected behavior related to hostname comparisons.

// Example: Check for the vulnerable logic in isSSRFSafeURL()
if (strpos($_SERVER['HTTP_HOST'], $webSiteRootURL) !== false) {
  // Vulnerable shortcircuit
}

• generic web: Monitor access logs for requests to the AVideo server using non-standard ports (e.g., 8080, 8443) or unusual hostnames. • generic web: Check response headers for unexpected content or indicators of data exfiltration. • generic web: Use curl to test SSRF bypass by attempting to access internal resources using the site's hostname and a non-standard port.

curl -v --connect-timeout 5 http://your-avideo-site.com:8080/internal/resource

1. 2026-04-21Disclosure

   disclosure

1. Reserviert2026-04-16
2. Veröffentlicht2026-04-21
3. Geändert2026-04-22
4. EPSS aktualisiert2026-04-29

The primary mitigation for CVE-2026-41060 is to upgrade AVideo to version 29.1 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) rule to block requests with non-standard ports on the webSiteRootURL hostname. Additionally, review and restrict access to the web-accessible path where the response body is saved to minimize potential data exposure. Monitor AVideo logs for unusual outbound requests originating from the server.