WWBN AVideo tiene una SSRF a través de un hostname del mismo dominio con omisiones de puerto alternativos isSSRFSafeURL

The SSRF vulnerability in AVideo allows an attacker to craft requests to arbitrary ports on the AVideo server, effectively bypassing intended security controls. This can be exploited to access internal services and resources that are not publicly exposed. The response body is saved to a web-accessible path, enabling full exfiltration of sensitive data. An attacker could potentially read configuration files, access internal APIs, or even interact with other services running on the same server, leading to a significant compromise of the system and its data.

Organizations using AVideo in production environments, particularly those with sensitive data or internal services accessible via the web server, are at risk. Shared hosting environments where multiple users share the same AVideo instance are also particularly vulnerable, as an attacker could potentially exploit the vulnerability to access data belonging to other users.

• php: Examine the objects/functions.php file for the isSSRFSafeURL() function and its shortcircuit logic. Look for modifications or unexpected behavior related to hostname comparisons.

// Example: Check for the vulnerable logic in isSSRFSafeURL()
if (strpos($_SERVER['HTTP_HOST'], $webSiteRootURL) !== false) {
  // Vulnerable shortcircuit
}

• generic web: Monitor access logs for requests to the AVideo server using non-standard ports (e.g., 8080, 8443) or unusual hostnames. • generic web: Check response headers for unexpected content or indicators of data exfiltration. • generic web: Use curl to test SSRF bypass by attempting to access internal resources using the site's hostname and a non-standard port.

curl -v --connect-timeout 5 http://your-avideo-site.com:8080/internal/resource

1. 2026-04-21Disclosure

   disclosure

1. Reservado2026-04-16
2. Publicada2026-04-21
3. Modificada2026-04-22
4. EPSS actualizado2026-04-29

The primary mitigation for CVE-2026-41060 is to upgrade AVideo to version 29.1 or later, which includes the fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests with non-standard ports or suspicious hostnames. Additionally, review and restrict the webSiteRootURL configuration to only include trusted domains. After upgrading, confirm the fix by attempting to access a non-standard port on the AVideo server and verifying that the request is blocked.