Vulnerability Spotlight: Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass

Vulnerabilities


Claudio Bozzato of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. 

Cisco Talos recently discovered multiple vulnerabilities in the WWBN AVideo web application that could allow an attacker to carry out a wide range of malicious actions, including command injection and authentication bypass. 

AVideo is an open-source web application that allows users to build a video streaming and sharing platform. Anyone who joins the community can host videos on-demand, launch a live stream or encode different video formats. 

TALOS-2022-1542 (CVE-2022-32777 – CVE-2022-32778), TALOS-2022-1549 (CVE-2022-32761) and TALOS-2022-1550 (CVE-2022-28710) are information disclosure vulnerabilities that are triggered if an adversary sends the targeted instance a specially crafted HTTP packet. TALOS-2022-1550 and TALOS-2022-1549 could allow the adversary to read arbitrarily selected files, while TALOS-2022-1542 could allow them to steal the session cookie. 

Some of the most serious vulnerabilities discovered in this product are code injection issues. TALOS-2022-1546 (CVE-2022-30534), TALOS-2022-1551 (CVE-2022-33147 – CVE-2022-33149) and TALOS-2022-1548 (CVE-2022-32572) are triggered in a similar way, but instead could lead to arbitrary command execution. 

 That could allow an attacker to gain access to an administrator’s account: 

The app also contains three privilege escalation vulnerabilities: TALOS-2022-1534 (CVE-2022-29468), TALOS-2022-1535 (CVE-2022-30605) and TALOS-2022-1545 (CVE-2022-32282). An attacker could exploit TALOS-2022-1545 to log in with only a hashed version of a user’s password. TALOS-2022-1534 and TALOS-2022-1535 could be triggered if the attacker sends the user a specially crafted HTTP request. 

Cisco Talos worked with WWBN to responsibly disclose and patch these vulnerabilities in adherence to Cisco’s vulnerability disclosure policy. 

Talos tested and confirmed the following software is affected by these vulnerabilities: WWBN AVideo, version 11.6 and dev master commit 3f7c0364. 

The following SNORTⓇ rules will detect exploitation attempts against this vulnerability: 59993 – 59998, 60003 – 60006, 60071, 60072, 60079, 60080, 60145 – 60153, 60204, 60205 and 60208. Additional rules may be released in the future and current rules are subject to change, pending additional vulnerability information. For the most current rule information, please refer to your Cisco Secure Firewall Management Center or Snort.org.