Summary
AVideo contains a critical command-injection vulnerability in its live-streaming workflow. An unauthenticated remote attacker who can provide attacker-controlled responses to an encoder may bypass streaming authorization and cause operating-system commands to execute as the web-server user.
AVideo contains a critical command-injection vulnerability in its live-streaming workflow. An unauthenticated remote attacker who can provide attacker-controlled responses to an encoder may bypass streaming authorization and cause operating-system commands to execute as the web-server user.
Affected context
The issue occurs in AVideo deployments using the live-streaming endpoint
view/videosListToLive.php. The vulnerable path accepts attacker-influenced
streamer and video-list data, trusts login-state JSON without independently
validating authorization, and passes video paths into ffprobe and ffmpeg
through shell commands without adequate argument escaping. Exploitation depends
on the encoder being able to reach an attacker-controlled HTTP service and on
the application processing the returned video-list data.
The issue occurs in AVideo deployments using the live-streaming endpoint
view/videosListToLive.php. The vulnerable path accepts attacker-influenced
streamer and video-list data, trusts login-state JSON without independently
validating authorization, and passes video paths into ffprobe and ffmpeg
through shell commands without adequate argument escaping. Exploitation depends
on the encoder being able to reach an attacker-controlled HTTP service and on
the application processing the returned video-list data.
Exploit preconditions
- Attack surface: AVideo's remotely reachable live-streaming endpoint and its encoder request flow
- Required access: No legitimate AVideo credentials are required; the attacker must be able to host an HTTP service reachable by the encoder
- Trigger point: Processing attacker-controlled streamer login-state data and video paths during live-stream preparation
- Why exploitation is possible: The endpoint forwards attacker-supplied values, does not independently verify the API secret or streamer authorization, and interpolates returned paths into shell commands without reliable argument escaping
- Attack surface: AVideo's remotely reachable live-streaming endpoint and its encoder request flow
- Required access: No legitimate AVideo credentials are required; the attacker must be able to host an HTTP service reachable by the encoder
- Trigger point: Processing attacker-controlled streamer login-state data and video paths during live-stream preparation
- Why exploitation is possible: The endpoint forwards attacker-supplied values, does not independently verify the API secret or streamer authorization, and interpolates returned paths into shell commands without reliable argument escaping
Why this happens
The primary defect is OS command injection, mapped to CWE-78. The application treats externally controlled video-path data as safe command input and constructs shell commands for media inspection or processing without separating data from command syntax. The same workflow also compounds the risk by trusting attacker-controlled authentication-state responses and by failing to enforce authorization independently of the supplied streamer data.
The primary defect is OS command injection, mapped to CWE-78. The application treats externally controlled video-path data as safe command input and constructs shell commands for media inspection or processing without separating data from command syntax. The same workflow also compounds the risk by trusting attacker-controlled authentication-state responses and by failing to enforce authorization independently of the supplied streamer data.
Potential impact
- Arbitrary operating-system commands may execute as the web-server user
- Attackers could disclose database contents or stored streamer credentials
- Application files owned by the web-server user could be modified or deleted
- Persistence mechanisms could be established within the affected runtime
- The upstream video platform could be compromised using exposed credentials
- Encoder or live-streaming availability could be disrupted
- Additional systems may be affected if the service account has excessive privileges
- Arbitrary operating-system commands may execute as the web-server user
- Attackers could disclose database contents or stored streamer credentials
- Application files owned by the web-server user could be modified or deleted
- Persistence mechanisms could be established within the affected runtime
- The upstream video platform could be compromised using exposed credentials
- Encoder or live-streaming availability could be disrupted
- Additional systems may be affected if the service account has excessive privileges
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from media-processing
workflows and strengthening trust boundaries around streaming authorization.
Common defensive patterns include:
- Invoke media tools through argument-array APIs rather than shell command strings
- Treat video paths, URLs, and response fields as untrusted data and apply strict allowlisting
- Reject shell metacharacters and unexpected path formats as a defense-in-depth measure
- Validate authentication state and API secrets locally against trusted server-side records
- Enforce streamer authorization and allowlist checks on every relevant execution path
- Avoid accepting attacker-controlled service endpoints for security-sensitive responses
- Run encoders and web workers with least privilege, isolated filesystems, and restricted network access
- Protect stored credentials and avoid exposing them to processes that do not require them
Mitigation generally focuses on removing shell interpretation from media-processing
workflows and strengthening trust boundaries around streaming authorization.
Common defensive patterns include:
- Invoke media tools through argument-array APIs rather than shell command strings
- Treat video paths, URLs, and response fields as untrusted data and apply strict allowlisting
- Reject shell metacharacters and unexpected path formats as a defense-in-depth measure
- Validate authentication state and API secrets locally against trusted server-side records
- Enforce streamer authorization and allowlist checks on every relevant execution path
- Avoid accepting attacker-controlled service endpoints for security-sensitive responses
- Run encoders and web workers with least privilege, isolated filesystems, and restricted network access
- Protect stored credentials and avoid exposing them to processes that do not require them
How teams detect issues like this
Detection can combine source analysis, runtime monitoring, and deployment policy controls.
Useful approaches include:
- Static analysis for concatenation or interpolation of request, JSON, URL, and path values into
execor shell commands - Code review checks for media-tool invocations that use shell parsing instead of structured arguments
- Tests that supply metacharacters and unexpected path forms to all media-processing inputs
- Review of authentication flows for trusted remote JSON responses and missing server-side secret validation
- Monitoring child processes spawned by the web server or encoder for unexpected shells, utilities, or network activity
- Policy enforcement requiring least-privilege service accounts and restricted outbound connections
- Automated security review tools can help identify command-construction and trust-boundary violations
Detection can combine source analysis, runtime monitoring, and deployment policy controls.
Useful approaches include:
- Static analysis for concatenation or interpolation of request, JSON, URL, and path values into
execor shell commands - Code review checks for media-tool invocations that use shell parsing instead of structured arguments
- Tests that supply metacharacters and unexpected path forms to all media-processing inputs
- Review of authentication flows for trusted remote JSON responses and missing server-side secret validation
- Monitoring child processes spawned by the web server or encoder for unexpected shells, utilities, or network activity
- Policy enforcement requiring least-privilege service accounts and restricted outbound connections
- Automated security review tools can help identify command-construction and trust-boundary violations
