Summary
AVideo contains server-side request forgery (SSRF) paths that allow unauthenticated attackers to influence destinations requested by the server. Under affected configurations, an attacker may read internal HTTP or HTTPS responses, access cloud instance metadata, reach internal TCP services, or send requests to internal FTP services.
AVideo contains server-side request forgery (SSRF) paths that allow unauthenticated attackers to influence destinations requested by the server. Under affected configurations, an attacker may read internal HTTP or HTTPS responses, access cloud instance metadata, reach internal TCP services, or send requests to internal FTP services.
Affected context
The vulnerability occurs in AVideo request-handling and authentication-related flows that accept caller-controlled URLs. Risk is increased when destination validation only checks URL syntax, permits private or link-local addresses, accepts self-signed HTTPS certificates, or treats an empty operator allowlist as permitting all destinations. A separate pre-authentication FTP path may also allow attacker-controlled hosts and ports to reach internal FTP services.
The vulnerability occurs in AVideo request-handling and authentication-related flows that accept caller-controlled URLs. Risk is increased when destination validation only checks URL syntax, permits private or link-local addresses, accepts self-signed HTTPS certificates, or treats an empty operator allowlist as permitting all destinations. A separate pre-authentication FTP path may also allow attacker-controlled hosts and ports to reach internal FTP services.
Exploit preconditions
- Attack surface: Unauthenticated web endpoints that process attacker-controlled URL, cookie, or video URL values
- Required access: No account or operator interaction is required
- Trigger points: Login-related request processing, server-side URL fetching, and the FTP download workflow
- Why exploitation is possible: Destination validation does not consistently enforce network-boundary restrictions, and fetched responses can be exposed through application responses or session-related data
- Additional condition: The default empty destination allowlist may permit requests to arbitrary sites
- Attack surface: Unauthenticated web endpoints that process attacker-controlled URL, cookie, or video URL values
- Required access: No account or operator interaction is required
- Trigger points: Login-related request processing, server-side URL fetching, and the FTP download workflow
- Why exploitation is possible: Destination validation does not consistently enforce network-boundary restrictions, and fetched responses can be exposed through application responses or session-related data
- Additional condition: The default empty destination allowlist may permit requests to arbitrary sites
Why this happens
The underlying issue is server-side request forgery, mapped to CWE-918. AVideo accepts attacker-influenced destinations after syntax validation without reliably distinguishing public resources from loopback, private, link-local, or other restricted networks. The implementation also weakens HTTPS authenticity checks and exposes fetched content through application-controlled response data. The FTP variant applies the same trust failure to attacker-controlled FTP hosts and ports.
The underlying issue is server-side request forgery, mapped to CWE-918. AVideo accepts attacker-influenced destinations after syntax validation without reliably distinguishing public resources from loopback, private, link-local, or other restricted networks. The implementation also weakens HTTPS authenticity checks and exposes fetched content through application-controlled response data. The FTP variant applies the same trust failure to attacker-controlled FTP hosts and ports.
Potential impact
- An attacker may read internal HTTP or HTTPS responses
- Cloud instance-metadata credentials could be disclosed
- Internal TCP services may be reached from the application server
- Internal FTP services could be queried
- Self-signed or otherwise untrusted HTTPS endpoints may be accepted
- Internal administrative interfaces or sensitive service data could be exposed
- Network segmentation assumptions may be weakened
- An attacker may read internal HTTP or HTTPS responses
- Cloud instance-metadata credentials could be disclosed
- Internal TCP services may be reached from the application server
- Internal FTP services could be queried
- Self-signed or otherwise untrusted HTTPS endpoints may be accepted
- Internal administrative interfaces or sensitive service data could be exposed
- Network segmentation assumptions may be weakened
General mitigation guidance
Mitigation generally focuses on enforcing destination trust boundaries before any outbound connection is made.
Common defensive patterns include:
- Resolve hostnames and reject loopback, private, link-local, multicast, reserved, and other restricted address ranges for every supported protocol
- Re-check the final destination after DNS resolution and across redirects to reduce rebinding and redirect-based bypasses
- Use explicit, non-empty allowlists of approved schemes, hosts, ports, and network destinations
- Disable unnecessary outbound protocols, including FTP, and use secure-by-default transport settings
- Enable TLS certificate and hostname verification rather than accepting untrusted certificates
- Avoid reflecting raw fetched responses into authentication or API response objects
- Apply egress network policies, metadata-service protections, and least-privilege service accounts
- Treat client-controlled cookies and URL parameters as untrusted regardless of their apparent naming or format
Mitigation generally focuses on enforcing destination trust boundaries before any outbound connection is made.
Common defensive patterns include:
- Resolve hostnames and reject loopback, private, link-local, multicast, reserved, and other restricted address ranges for every supported protocol
- Re-check the final destination after DNS resolution and across redirects to reduce rebinding and redirect-based bypasses
- Use explicit, non-empty allowlists of approved schemes, hosts, ports, and network destinations
- Disable unnecessary outbound protocols, including FTP, and use secure-by-default transport settings
- Enable TLS certificate and hostname verification rather than accepting untrusted certificates
- Avoid reflecting raw fetched responses into authentication or API response objects
- Apply egress network policies, metadata-service protections, and least-privilege service accounts
- Treat client-controlled cookies and URL parameters as untrusted regardless of their apparent naming or format
How teams detect issues like this
Detection can combine source analysis, runtime monitoring, and deployment policy checks.
Useful approaches include:
- Static analysis for HTTP, HTTPS, and FTP client calls whose host, port, scheme, or URL originates from request parameters or cookies
- Code review checks for URL validation that performs syntax checks without IP-range, redirect, or DNS-resolution controls
- Searches for disabled TLS verification and response bodies copied into session or API response objects
- Tests covering loopback, private, link-local, metadata, IPv6, redirect, DNS-rebinding, and non-HTTP destinations
- Egress firewall and proxy logs monitoring application connections to internal address ranges or metadata endpoints
- Policy enforcement requiring explicit outbound destination allowlists and approved URL schemes
- Automated security review tools that identify SSRF-prone data flows and unsafe network-client configuration
Detection can combine source analysis, runtime monitoring, and deployment policy checks.
Useful approaches include:
- Static analysis for HTTP, HTTPS, and FTP client calls whose host, port, scheme, or URL originates from request parameters or cookies
- Code review checks for URL validation that performs syntax checks without IP-range, redirect, or DNS-resolution controls
- Searches for disabled TLS verification and response bodies copied into session or API response objects
- Tests covering loopback, private, link-local, metadata, IPv6, redirect, DNS-rebinding, and non-HTTP destinations
- Egress firewall and proxy logs monitoring application connections to internal address ranges or metadata endpoints
- Policy enforcement requiring explicit outbound destination allowlists and approved URL schemes
- Automated security review tools that identify SSRF-prone data flows and unsafe network-client configuration
