WWBN AVideo DNS-Rebinding Vulnerability in EpgParser.php and Async Receive Endpoint

A vulnerability allowing DNS-rebinding attacks has been identified in WWBN AVideo versions through 29.0. The issue arises in EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations, where the $resolvedIP output parameter of the isSSRFSafeURL() function is not utilized for DNS pinning via CURLOPT_RESOLVE. This oversight creates a time-of-check-to-time-of-use (TOCTOU) vulnerability, enabling potential exploitation through DNS rebinding attacks.

Impact

Exploitation of this vulnerability could lead to DNS-rebinding attacks, allowing an attacker to manipulate DNS resolutions and potentially intercept or modify traffic.