AVideo: 通过 RTMP 回调 on_publish_done.php 实现未授权的直播流终止

AVideo Live插件中的CVE-2026-34731允许未经身份验证的用户终止任何活动直播流。onpublishdone.php端点处理RTMP回调事件以在数据库中将流标记为已完成，但未执行任何身份验证或授权检查。这意味着攻击者无需登录即可中断其他用户的直播。影响重大，可能导致直播内容丢失、重要事件中断以及平台声誉受损。CVSS严重程度评分为7.5，表明风险较高。

Organizations and individuals using the wwbn/avideo Live plugin for live streaming are at risk, particularly those running versions 26.0 and below. Shared hosting environments where multiple users share the same server instance are especially vulnerable, as an attacker could potentially impact all live streams on the server.

• php: Examine web server access logs for POST requests to onpublishdone.php originating from unusual or unauthorized IP addresses. • php: Use grep to search plugin files for the onpublishdone.php endpoint and related code, looking for missing authentication checks. • generic web: Monitor network traffic for POST requests to onpublishdone.php with potentially malicious payloads. • generic web: Check response headers for unusual or unexpected behavior after sending requests to onpublishdone.php.

1. 2026-04-01Disclosure

   disclosure

1. 已保留2026-03-30
2. 发布日期2026-04-01
3. EPSS 更新日期2026-04-08

目前，AVideo开发者尚未提供官方修复程序。最有效的即时缓解措施是，在发布更新之前禁用Live插件。作为临时措施，可以实施Web应用程序防火墙（WAF）以阻止来自非受信任来源的onpublishdone.php上的POST请求。积极监控服务器日志中与此端点相关的可疑活动至关重要。AVideo用户应随时了解安全更新，并在可用时应用补丁。此端点中缺乏身份验证代表了开发者需要解决的基本缺陷。