AVideo has an unauthenticated decrypt oracle leaking any ciphertext

Summary

The API plugin exposes a decryptString action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., view/url2Embed.json.php), so any user can recover protected tokens/metadata. Severity: High.

Details

• Entry: plugin/API/get.json.php is unauthenticated.
• Handler: plugin/API/API.php get_api_decryptString() (lines ~5945–5966):

  $string = decryptString($_REQUEST['string']);
  return new ApiObject($string, empty($string));
  

  No APISecret or user check occurs before decrypting.
• Public ciphertext source: view/url2Embed.json.php returns playLink/playEmbedLink (encryptString(json_encode(...))) to any caller.

PoC

1. Obtain ciphertext:

   GET /view/url2Embed.json.php?url=https://example.com/video.mp4
   

   Copy playLink.
2. Decrypt without auth:

   POST /plugin/API/get.json.php?APIName=decryptString
   Content-Type: application/x-www-form-urlencoded
   
   string=<playLink ciphertext>
   

   Response contains the plaintext JSON (videoLink, title, users_id, etc.).

Impact

• Any encrypted payload produced by the platform can be decrypted by anyone.
• Leaks tokens/links intended to be confidential; enables replay and tampering where secrecy was assumed.

Mitigation

• Require API secret or authenticated/authorized user for decryptString, or remove the endpoint.
• Prefer one-way signatures (HMAC) instead of exposing generic decryption.
• Rotate encryption keys/salts after patch to invalidate exposed ciphertexts.