GHSA-2vg4-rrx4-qcpqmedium5.3

AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

The advisory, in context

Summary

The plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require User::isAdmin().

Details

The entire file at plugin/API/check.ffmpeg.json.php:

<?php
$configFile = __DIR__.'/../../videos/configuration.php';
require_once $configFile;
header('Content-Type: application/json');

$obj = testFFMPEGRemote();

die(json_encode($obj));

No User::isAdmin(), User::isLogged(), or any access control check exists.

Compare with sibling endpoints in the same directory:

kill.ffmpeg.json.php checks User::isAdmin()
list.ffmpeg.json.php checks User::isAdmin()

Proof of Concept

curl "https://your-avideo-instance.com/plugin/API/check.ffmpeg.json.php"

Returns information about whether the platform uses a standalone FFmpeg server and its current reachability.

Impact

Infrastructure reconnaissance revealing the encoding architecture. Limited direct impact but aids targeted attack planning.

Recommended Fix

Add an admin authentication check at plugin/API/check.ffmpeg.json.php:3, after require_once $configFile;:

if (!User::isAdmin()) {
    forbiddenPage('Admin only');
}

Found by aisafe.io

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 26.0 (inclusive)

No fix recorded for this interval.

17 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "26.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0"
  ]
}

Set up in your agent.

Investigate in your agent.