Vulnerability Spotlight: Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass

_
_

_Claudio Bozzato of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. _

Cisco Talos recently discovered multiple vulnerabilities in the WWBN AVideo web application that could allow an attacker to carry out a wide range of malicious actions, including command injection and authentication bypass.

AVideo is an open-source web application that allows users to build a video streaming and sharing platform. Anyone who joins the community can host videos on-demand, launch a live stream or encode different video formats.

TALOS-2022-1542 (CVE-2022-32777 - CVE-2022-32778), TALOS-2022-1549 (CVE-2022-32761) and TALOS-2022-1550 (CVE-2022-28710) are information disclosure vulnerabilities that are triggered if an adversary sends the targeted instance a specially crafted HTTP packet. TALOS-2022-1550 and TALOS-2022-1549 could allow the adversary to read arbitrarily selected files in the webserver host, while TALOS-2022-1542 could allow them to steal the session cookie, leading, in the worst case, to takeover of an admin account.

Some of the most serious vulnerabilities discovered in this product are command execution issues. TALOS-2022-1546 (CVE-2022-30534) and TALOS-2022-1548 (CVE-2022-32572) are triggered in a similar way, and both lead to arbitrary command execution via command injection. TALOS-2022-1547 (CVE-2022-30547) is a directory traversal vulnerability that happens while extracting a zip file and eventually leads to arbitrary command execution.

That could allow an attacker to gain access to an administrator’s account:

• TALOS-2022-1537 (CVE-2022-26842)
• TALOS-2022-1538 (CVE-2022-32770 - CVE-2022-32772)
• TALOS-2022-1539 (CVE-2022-30690)
• TALOS-2022-1540 (CVE-2022-28712)

The app also contains three vulnerabilities that can be used for privilege escalation: TALOS-2022-1534 (CVE-2022-29468), TALOS-2022-1535 (CVE-2022-30605) and TALOS-2022-1545 (CVE-2022-32282). An attacker could exploit TALOS-2022-1545 to log in with only a hashed version of a user’s password. TALOS-2022-1534 and TALOS-2022-1535 could be triggered if the attacker can trick the user to make a specially crafted HTTP request. Finally, TALOS-2022-1551 (CVE-2022-33147-CVE-2022-33149) is a SQL injection vulnerability that can be used to escalate privileges, for example by extracting an admin password hash that can be used to log in (as explained in TALOS-2022-1545). Cisco Talos worked with WWBN to coordinate disclosure and allow them to patch these vulnerabilities in adherence to Cisco’s vulnerability disclosure policy.

Talos tested and confirmed the following software is affected by these vulnerabilities: WWBN AVideo, version 11.6 and dev master commit 3f7c0364.

The following SNORTⓇ rules will detect exploitation attempts against this vulnerability: 59993 – 59998, 60003 – 60006, 60071, 60072, 60079, 60080, 60145 – 60153, 60204, 60205 and 60208. Additional rules may be released in the future and current rules are subject to change, pending additional vulnerability information. For the most current rule information, please refer to your Cisco Secure Firewall Management Center or Snort.org.