AVideoにおいて、認証されていないLiveLinks ProxyでIPv4-Mapped IPv6アドレスを介したSSRF保護のバイパスの脆弱性

The SSRF vulnerability in AVideo's plugin/LiveLinks/proxy.php endpoint stems from a flawed isSSRFSafeURL() function. This function fails to properly validate URLs when IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) are used. An attacker can exploit this by crafting a request with a malicious IPv4-mapped IPv6 URL, bypassing the intended security checks. This allows them to make requests to internal services, cloud metadata endpoints (potentially exposing API keys and credentials), and even localhost resources. The potential blast radius is significant, as an attacker could gain unauthorized access to sensitive data and potentially compromise the entire system.

Organizations utilizing AVideo in environments with sensitive internal resources or cloud integrations are at risk. Shared hosting environments where AVideo is deployed alongside other applications are particularly vulnerable, as a successful exploitation could potentially impact other tenants.

• php: Examine access logs for requests to plugin/LiveLinks/proxy.php containing IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1). • generic web: Use curl to test the endpoint with an IPv4-mapped IPv6 address and verify that the request is blocked.

curl -v 'http://your-avideo-server/plugin/LiveLinks/proxy.php?url=http://::ffff:127.0.0.1'

1. 2026-03-20Disclosure

   disclosure

1. 予約済み2026-03-20
2. 公開日2026-03-20
3. 更新日2026-03-25
4. EPSS 更新日2026-03-31

The primary mitigation for CVE-2026-33480 is to upgrade AVideo to a version containing the fix. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing IPv4-mapped IPv6 addresses. Additionally, restrict network access to the plugin/LiveLinks/proxy.php endpoint to only trusted sources. Monitor access logs for suspicious requests using IPv4-mapped IPv6 addresses. After upgrading, confirm the fix by attempting to access a known internal resource via the plugin/LiveLinks/proxy.php endpoint with an IPv4-mapped IPv6 address; the request should be blocked.

最終更新

29.0最近