GHSA-2f9h-23f7-8gcx: AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments
SummaryThe `install/checkConfiguration.php` endpoint performs full application initialization — database setup, admin account creation, and configuration file write — from unauthenticated POST input. The only guard is checking whether `videos/configuration.php` already exists. On uninitialized deployments, any remote attacker can complete the installation with attacker-controlled credentials and an attacker-controlled database, gaining full administrative access.Affected Component`install/checkConfiguration.php` — entire file (lines 1-273)DescriptionNo authentication or access restriction on installer endpointThe `checkConfiguration.php` file performs the most privileged operations in the application — creating the database schema, the admin account, and the configuration file — with no authentication, no setup token, no CSRF protection, and no IP restriction. The sole guard is a file-existence check:If `videos/configuration.php` does not exist (fresh deployment, container restart without persistent storage, re-deployment), the entire installer runs with attacker-controlled POST parameters.Attacker-controlled database host eliminates credential guessingUnlike typical installer exposure vulnerabilities where the attacker must guess the target's database credentials, this endpoint allows the attacker to supply their own database host:The attacker can:Run their own MySQL server with the AVideo schema pre-loadedSet `databaseHost` to their server's IPThe connection succeeds (attacker controls the DB)The configuration file is written pointing the application at the attacker's database permanentlyAdmin account creation with unsanitized inputThe admin user is created with direct POST parameter concatenation into SQL:This has two issues: (1) the attacker controls the admin password, and (2) `$_POST['contactEmail']` is directly concatenated into SQL without escaping (SQL injection).Configuration file written with attacker-controlled valuesThe configuration file is written to disk with all attacker-supplied values embedded:The `$content` variable (built at lines 188-236) embeds `$_POST['databaseHost']`, `$_POST['databaseUser']`, `$_POST['databasePass']`, `$_POST['webSiteRootURL']`, `$_POST['systemRootPath']`, and `$_POST['salt']` directly into the PHP configuration file.Inconsistent defense: CLI installer is protected, web endpoint is notThe CLI installer (`install/install.php`) properly restricts access:The web endpoint (`checkConfiguration.php`) lacks any equivalent protection, creating an inconsistent defense pattern.No web server protection on install directoryThere is no `.htaccess` file in the `install/` directory. The root `.htaccess` does not block access to `install/`. The endpoint is directly accessible at `/install/checkConfiguration.php`.Execution chainAttacker discovers an AVideo instance where `videos/configuration.php` does not exist (fresh or re-deployed)Attacker sends POST to `/install/checkConfiguration.php` with their own database host, admin password, and site configurationThe script connects to the attacker's database (or the target's with guessed/default credentials)Tables are created, admin user is inserted with attacker's password`configuration.php` is written to disk, permanently configuring the applicationAttacker logs in as admin with full control over the applicationProof of Concept**Step 1:** Set up an attacker-controlled MySQL server with the AVideo schema:**Step 2:** Send the installation request to the target:**Step 3:** Log in as admin:The attacker now has full administrative access. If using their own database, they control all application data.Impact**Full application takeover:** Attacker becomes the sole admin with complete control**Persistent backdoor via configuration:** The `videos/configuration.php` file is written with attacker-controlled database credentials, ensuring persistent access even after the attack**Data exfiltration:** If pointing to the attacker's database, all future user data (registrations, uploads, comments) flows to the attacker**Remote code execution potential:** Admin access in AVideo enables file uploads and plugin management, which can lead to arbitrary PHP execution**SQL injection bonus:** `$_POST['contactEmail']` on line 120 is directly concatenated into SQL, allowing additional database manipulationRecommended RemediationOption 1: Add a one-time setup token (preferred)Generate a random setup token during deployment that must be provided to complete installation:Option 2: Restrict installer to localhost/CLI onlyBlock web access to the installer entirely:Additionally, add an `.htaccess` file in the `install/` directory:Additional fixes needed**Parameterize SQL queries** on line 120 to prevent SQL injection:**Upgrade password hashing** from `md5()` to `password_hash()` with `PASSWORD_BCRYPT` or `PASSWORD_ARGON2ID`.CreditThis vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai).
CVSS v3.1: 8.1