GHSA-9hv9-gvwm-95f2: AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
SummaryThe standalone live stream control endpoint at `plugin/Live/standAloneFiles/control.json.php` accepts a user-supplied `streamerURL` parameter that overrides where the server sends token verification requests. An attacker can redirect token verification to a server they control that always returns `{"error": false}`, completely bypassing authentication. This grants unauthenticated control over any live stream on the platform, including dropping active publishers, starting/stopping recordings, and probing stream existence.DetailsThe vulnerability exists because the `streamerURL` parameter is accepted directly from user input with no validation:**`plugin/Live/standAloneFiles/control.json.php:77-79`** — User input overrides server config:**`plugin/Live/standAloneFiles/control.json.php:83-91`** — The user-controlled value is assigned to the request object:**`plugin/Live/standAloneFiles/control.json.php:115-126`** — Token verification is sent to the attacker-controlled URL:The legitimate `verifyToken.json.php` performs cryptographic token validation via `Live::decryptHash()` and checks token expiry (12-hour window). By redirecting verification to an attacker server, all of this is bypassed — the attacker's server simply responds with `{"error": false}`.After authentication is bypassed, the attacker can execute any of the four supported commands (lines 150-186): `record_start`, `record_stop`, `drop_publisher`, and `is_recording`, which issue control commands to the local NGINX RTMP control module.SSL verification is also explicitly disabled (lines 119-124), meaning the SSRF request will follow any attacker URL without certificate validation.Notably, the developers were aware of this exact attack pattern and fixed it in the sibling file `standAloneFiles/saveDVR.json.php` on 2026-03-19 with an explicit comment: *"SECURITY: User-supplied webSiteRootURL is intentionally NOT accepted. Allowing it would enable SSRF."* The same fix was not applied to `control.json.php`.PoC**Step 1:** Set up an attacker server that returns `{"error": false}` for all requests.**Step 2:** Drop a victim's live stream (kill their broadcast):Expected response (authentication bypassed, command executed):**Step 3:** Start unauthorized recording of a victim's stream:**Step 4:** Probe whether a stream name is active:Impact**Denial of Service on Live Streams:** Any unauthenticated attacker can terminate any active live broadcast using `drop_publisher`, causing immediate disruption for streamers and viewers.**Unauthorized Recording:** An attacker can start recording any live stream without authorization using `record_start`, potentially capturing private or sensitive content.**Stream Enumeration:** The `is_recording` command allows probing for valid stream names.**SSRF:** The server makes an outbound HTTP request to an attacker-controlled URL via `file_get_contents()`, which could be used to scan internal services or exfiltrate data via the request URL.**No authentication required:** The entire attack is performed without any credentials.Recommended FixRemove the `streamerURL` request parameter override entirely, matching the fix already applied in `saveDVR.json.php`. In `plugin/Live/standAloneFiles/control.json.php`, replace lines 77-79:
CVSS v3.1: 9.4