Summary
WWBN AVideo contains a stored cross-site scripting vulnerability in video title handling, where doubly encoded entities can bypass sanitization and persist as executable markup. An authenticated uploader may be able to trigger script execution when affected titles are rendered in trending, gallery, embed, or playlist pages.
Affected context
The vulnerability affects AVideo deployments within the stated version range when authenticated uploaders can submit or modify video titles. It becomes risky when title values are sanitized before entity decoding, processed more than once, and later rendered in pages without context-appropriate output encoding.
Exploit preconditions
- Attack surface: Video title submission and subsequent title rendering
- Required access: Authenticated uploader privileges
- Trigger point: Saving a title and viewing affected trending, gallery, embed, or playlist pages
- Why exploitation is possible: Double encoding, repeated processing, and tag stripping before entity decoding may allow markup to be stored and interpreted by browsers
Why this happens
The underlying bug is an output-encoding and sanitization order flaw mapped to CWE-79: Improper Neutralization of Input During Web Page Generation. The application removes tags before decoding entities and applies this processing through multiple title-handling paths, allowing encoded markup to become active after sanitization. Rendering the resulting value without context-appropriate escaping permits stored script execution in viewers' browsers.
Potential impact
- Attacker-controlled script execution in the context of affected pages
- Theft of accessible session data or application tokens
- Unauthorized actions performed through a victim's browser
- Defacement or manipulation of rendered video metadata
- Exposure of sensitive information available to affected users
General mitigation guidance
Mitigation generally focuses on treating video titles as untrusted data throughout their lifecycle.
Common defensive patterns include:
- Applying context-aware output encoding at every HTML, attribute, URL, and JavaScript rendering sink
- Using allowlist-based validation for title content where formatting is not required
- Decoding entities before validation and sanitization, with a single well-defined canonicalization step
- Avoiding repeated or inconsistent sanitization routines across setters and persistence layers
- Using safe templating APIs that escape values by default
- Restricting uploader privileges and applying appropriate content security policies as defense in depth
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis rules for unescaped user-controlled values reaching HTML rendering sinks
- Code review of title setters, persistence methods, and template output contexts
- Tests using encoded, doubly encoded, and mixed-context input values
- Dynamic scanning of authenticated upload and content-rendering workflows
- Policy enforcement requiring context-aware encoding and safe templating
Automated code review and application security testing tools may help identify inconsistent sanitization and output encoding paths.
