AVideo presenta una Falsificación de Solicitud del Servidor (SSRF) autenticada a través de downloadURL en aVideoEncoder.json.php

The SSRF vulnerability in AVideo's aVideoEncoder.json.php API endpoint arises from insufficient validation of the downloadURL parameter. An authenticated attacker can exploit this by providing a malicious URL, causing the server to make requests to arbitrary destinations, including internal network endpoints. This could lead to the retrieval of sensitive data from internal services, potentially exposing credentials, configuration files, or other confidential information. The attacker's ability to interact with internal services significantly expands the potential blast radius of this vulnerability.

Organizations utilizing AVideo versions prior to 22.0, particularly those with internal services accessible via the network, are at risk. Shared hosting environments where multiple users share the same AVideo instance are also particularly vulnerable, as a compromised user account could be leveraged to exploit the SSRF vulnerability.

• php: Examine access logs for requests to aVideoEncoder.json.php with unusual or unexpected downloadURL parameters. Look for URLs pointing to internal IP addresses or non-standard ports.

grep 'aVideoEncoder.json.php' access.log | grep 'downloadURL='

• generic web: Use curl to test the endpoint with a known internal URL and verify that the request is blocked.

curl -v 'http://<avideo_server>/aVideoEncoder.json.php?downloadURL=http://169.254.169.254/mgmt/inventory' 

• generic web: Check response headers for unexpected content types or error messages indicating an internal server error when attempting an SSRF request.

1. 2026-02-25Disclosure

   disclosure

1. Reservado2026-02-23
2. Publicada2026-02-25
3. EPSS actualizado2026-03-23

The primary mitigation for CVE-2026-27732 is to upgrade to AVideo version 22.0 or later, which includes the necessary input validation to prevent SSRF attacks. If upgrading is not immediately feasible, implement a Web Application Firewall (WAF) rule to block requests with suspicious URLs. Additionally, consider implementing stricter input validation on the downloadURL parameter, enforcing an allow-list of permitted domains or protocols. After upgrading, confirm the fix by attempting to trigger an SSRF request with a known malicious URL; the request should be blocked.

Última actualización

29.0recientemente