AVideo Authorization Bypass Vulnerability Allowing Unauthorized Image Uploads on Comments

A vulnerability in AVideo versions prior to 20.0 allows any authenticated user to upload comment images to videos belonging to other users. While the upload endpoint verifies authentication, it fails to check video ownership. This oversight enables unauthorized image uploads to arbitrary videos.

Impact

Exploitation of this vulnerability could lead to unauthorized image uploads on videos, potentially allowing for the distribution of inappropriate or harmful content.

Reproduction

To reproduce this vulnerability, an authenticated user can upload comment images to videos owned by other users. The upload will be accepted without any ownership verification, allowing images to be added to videos arbitrarily.

Remediation

Users are advised to update to AVideo version 20.0 or later, where this vulnerability has been addressed.