AVideo Live-Streaming Endpoint Command Injection Vulnerability

AVideo, a video-sharing platform, contains a command injection vulnerability in its live-streaming endpoint prior to version 8.1.0.

The endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant isLogged and canStream without legitimate credentials. The endpoint requires only nonempty playlists_id and APISecret values; APISecret is forwarded rather than checked against a stored secret. This path never calls Streamer::isURLAllowed, so it works regardless of the operator's streamer allowlist.

The endpoint fetches a second attacker-controlled video-list response and interpolates videos[].path without shell argument escaping into ffprobe and ffmpeg commands passed to exec; isAudio calls isVideo to reach the ffprobe command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON.

• Impact includes disclosure of database and stored streamer credentials, compromise of the upstream platform using those credentials, modification of files owned by the web-server user, persistence, and denial of encoder service.
• Fixed in version 8.1.0.