Metasploit Module: AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery
Type: exploit
Path: modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb
Platform: %w[php unix linux win
Disclosure date: 2025-12-19
References: CVE-2025-34433, CVE-2025-34441, CVE-2025-34442, URL-https://github.com/WWBN/AVideo/pull/10284, URL-https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/, URL-https://www.vulncheck.com/advisories/avideo-unauthenticated-rce-via-predictable-installation-salt
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits an unauthenticated remote code execution (RCE) vulnerability
          in AVideo's notify.ffmpeg.json.php endpoint. The vulnerability stems from a critical
          cryptographic weakness in the salt generation mechanism combined with information
          disclosure vulnerabilities that allow an attacker to discover the encryption salt
          through offline bruteforce.

          Root Cause:
          During installation, AVideo generates an encryption salt using PHP's uniqid() function,
          which is not cryptographically secure. uniqid() generates a 13-character hexadecimal
          string composed of: 8 characters for Unix timestamp in hex, and 5 characters for
          microseconds in hex (0x00000 to 0xFFFFF = 1,048,576 possible values).

          Exploit Chain:
          1. Leak installation timestamp from /objects/categories.json.php (public endpoint)
          2. Leak video hashId from /objects/videosAndroid.json.php or /plugin/API/get.json.php
          3. Leak system root path from posterPortraitPath in video API responses
          4. Leak server timezones from /objects/getTimes.json.php
          5. Offline bruteforce of the remaining 5 microsecond characters using hashId comparison
          6. Use recovered salt to encrypt RCE payload for notify.ffmpeg.json.php eval()

          The notify.ffmpeg.json.php endpoint uses decryptString() to decrypt the callback parameter,
          which has a fallback mechanism: if decryption with saltV2 (cryptographically secure) fails,
          it retries with the old uniqid() salt. This fallback makes the RCE exploitable.

          Affected Versions:
          AVideo 14.3.1+ (introduced January 7, 2025). Requires: Fallback mechanism in
          encrypt_decrypt() (introduced January 15, 2024) and notify.ffmpeg.json.php with
          eval($callback) (introduced January 7, 2025).

          Note on v20.0: The vendor removed the posterPortraitPath leak but did NOT remove
          the legacy salt fallback or eval($callback). RCE remains exploitable using SYSTEM_ROOT.

          This vulnerability does not require authentication and can be exploited remotely by any
          attacker who can access the AVideo instance.

Check method (fingerprinting):
gather_info
    return CheckCode::Safe('notify.ffmpeg.json.php not found (requires 14.3.1+)') unless @notify_exists

    salt_provided = !datastore['SALT'].to_s.empty?
    unless salt_provided
      return CheckCode::Safe('categories.json.php inaccessible (timestamp leak required)') unless @timestamp_accessible
      return CheckCode::Safe('hashId endpoints inaccessible (videosAndroid.json.php or get.json.php required)') unless @hashid_accessible
    end

    return CheckCode::Appears("Vulnerable version #{@version} detected") if @version && @version >= Rex::Version.new('14.3.1')
    return CheckCode::Safe("Version #{@version} requires 14.3.1+") if @version

    CheckCode::Appears('Prerequisites met (version unknown)')
  end