GHSA-pw4v-x838-w5pg: AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
SummaryThe HLS streaming endpoint (`view/hls.php`) is vulnerable to a path traversal attack that allows an unauthenticated attacker to stream any private or paid video on the platform. The `videoDirectory` GET parameter is used in two divergent code paths — one for authorization (which truncates at the first `/` segment) and one for file access (which preserves `..` traversal sequences) — creating a split-oracle condition where authorization is checked against one video while content is served from another.DetailsThe vulnerability is a split-oracle between the authorization lookup and the filesystem path construction. When `hls.php` receives a request, it processes `$_GET['videoDirectory']` through two independent functions that interpret the input differently.**Step 1 — Authorization lookup truncates at first path segment** (`objects/video.php:1685-1688`):For input `public_video/../private_video`, `explode("/", ...)` yields `["public_video", "..", "private_video"]` and only `public_video` is used for the DB query. The authorization check at `hls.php:73` then runs against this public video:**Step 2 — File path construction preserves the traversal** (`objects/video.php:4622-4638`):`getPaths` extracts the clean filename (e.g., `public_video`) to build the base path `/videos/public_video/`. Then `str_replace($paths['filename'], '', $videoFilename)` replaces only the clean name from the full input, leaving the traversal intact: `/../private_video/index.m3u8`. The concatenation at line 4634 produces `/videos/public_video/../private_video/index.m3u8`, which the OS resolves to `/videos/private_video/index.m3u8`.**No mitigations exist in the path:**`fixPath()` (`objects/functionsFile.php:1116`) only normalizes slashes, does not filter `..`No `realpath()` call anywhere in the chainNo `..` filtering on the `videoDirectory` parameterThe traversal is in a query parameter, not the URL path, so web server path normalization does not applyPoC**Prerequisites:** An AVideo instance with at least one public video (filename: `public_video`) and one private/paid video (filename: `private_video`).**Step 1 — Confirm the private video is inaccessible directly:****Step 2 — Exploit the split-oracle to stream the private video:****Step 3 — Stream the private video content using the returned playlist:**The authorization check passes because it resolves `public_video` (the public video), while the file system serves `private_video`'s HLS stream.Impact**Any unauthenticated user** can stream any private, unlisted, or paid video on the platform by knowing or guessing its filename directory.**Paid content bypass:** Monetized videos protected by pay-per-view or subscription gates can be streamed for free.**Privacy violation:** Videos marked as private or restricted to specific user groups are fully accessible.**Content theft at scale:** Video filenames follow predictable patterns (e.g., `video_YYYYMMDD_XXXXX`), enabling enumeration. An attacker only needs one publicly accessible video to pivot to any other video on the instance.This affects all AVideo instances with at least one public video, which is the default configuration for any content platform.Recommended FixSanitize the `videoDirectory` parameter to reject path traversal sequences before any processing occurs. Apply this fix at the top of `view/hls.php`:Additionally, add a `realpath()` check in `getPathToFile` as defense-in-depth (`objects/video.php:4636`):
CVSS v3.1: 7.5