GHSA-wxjw-phj6-g75w: AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
SummaryThe `ImageGallery::saveFile()` method validates uploaded file content using `finfo` MIME type detection but derives the saved filename extension from the user-supplied original filename without an allowlist check. An attacker can upload a polyglot file (valid JPEG magic bytes followed by PHP code) with a `.php` extension. The MIME check passes, but the file is saved as an executable `.php` file in a web-accessible directory, achieving Remote Code Execution.DetailsThe vulnerability exists in `plugin/ImageGallery/ImageGallery.php` in the `saveFile()` method:**Root cause:** Line 93 extracts the extension from the user-supplied `$file['name']` and uses it directly in the saved filename. There is no check against an allowlist of safe extensions (e.g., `jpg`, `png`, `gif`, `webp`, `mp4`).**Why the MIME check is insufficient:** PHP's `finfo` with `FILEINFO_MIME_TYPE` inspects file content magic bytes. A file starting with JPEG magic bytes (`\xff\xd8\xff\xe0`) is identified as `image/jpeg` regardless of trailing content. Appending PHP code after the JPEG header creates a polyglot that passes the MIME check but executes as PHP when requested via the web server.**Why no server-level protection exists:** The root `.htaccess` at line 73 blocks dangerous extensions but uses the pattern `php[a-z0-9]+` — which matches `.php5`, `.phtml`, `.phar`, etc., but intentionally does **not** match plain `.php` (since the application itself requires PHP execution). There is no `.htaccess` in the `videos/` directory to disable PHP execution in the upload target.**Upload path:** Files are saved to `videos/{videoFilename}/ImageGallery/{uniqid}.php` — directly accessible via the web server.The upload endpoint at `plugin/ImageGallery/upload.json.php` requires:The ImageGallery plugin to be enabled (line 6-8)An authenticated user (line 10-12)The user must have manage permission on the video (line 18-20) — video owner or adminThe response at line 27 calls `listFiles()` which returns the full URL of each uploaded file, giving the attacker the exact path to their webshell.PoC**Prerequisites:** Authenticated AVideo user account that owns at least one Image or Gallery type video.**Step 1: Create a polyglot PHP/JPEG file****Step 2: Verify it passes finfo detection****Step 3: Upload via ImageGallery endpoint****Expected response:****Step 4: Execute the webshell**ImpactAn authenticated user with edit permission on any Image/Gallery video can achieve **Remote Code Execution** as the web server user. This allows:Reading sensitive configuration files (database credentials in `videos/configuration.php`)Full database access via the database credentialsReading/modifying/deleting any file accessible to the web server processLateral movement within the server's networkPotential privilege escalation depending on server configurationAny AVideo instance with the ImageGallery plugin enabled and user registration open is vulnerable. Since regular (non-admin) users can exploit this against their own videos, the barrier to exploitation is low.Recommended FixAdd an extension allowlist check in `saveFile()` immediately after extracting the extension. The extension should be validated against the same set of types as the MIME allowlist:Additionally, as defense-in-depth, add a `.htaccess` file to the `videos/` directory to disable PHP execution:
CVSS v3.1: 8.8