Описание
AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization
Summary
An unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints
(e.g. users_list) without logging in.
Details
objects/plugins.json.php is public and still exposes plugin object_data containing APISecret.
That secret is accepted by plugin/API/get.json.php as authentication.
PoC
- Get plugin config (contains
APISecret):
- Copy APISecret from response, then call API directly:
Impact
Unauthenticated disclosure of sensitive config (APISecret) leading to unauthorized access to protected API data.
Recommended fix
Requiring admin auth for full plugin inventory/config endpoint.
Пакеты
wwbn/avideo
<= 29.0
Отсутствует
Связанные уязвимости
WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.