Description
WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can store a videoLink pointing to a redirector, causing internal GET requests when visitors view the video, enabling internal port scanning via the embed-versus-video render oracle.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WWBN | AVideo | < 29.4.0 | 29.4.0 |
References
- GitHub Security Advisory (GHSA-m8q2-35pq-qrmc) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect third-party-advisory