WWBN AVideo YPTSocket Plugin Stored DOM Cross-Site Scripting Vulnerability

A stored DOM Cross-Site Scripting vulnerability has been identified in the WWBN AVideo platform, specifically in versions prior to 29.0, within the YPTSocket plugin. This vulnerability allows unauthenticated remote attackers to execute arbitrary JavaScript in the context of authenticated administrators who are currently viewing a page with the YPTSocket online-users debug panel. The issue arises because the plugin's WebSocket connection handler reads attacker-controlled query parameters from the WebSocket URL without proper validation. These parameters are then broadcasted to all connected clients, where the injected JavaScript is executed, potentially leading to unauthorized access to sensitive information such as non-HttpOnly cookies and the CSRF token, as well as the ability to perform actions on behalf of the administrator.

Impact

Exploitation of this vulnerability allows for stored DOM-based Cross-Site Scripting, where injected JavaScript is executed in the context of the affected user. In this case, it could lead to a complete administrative takeover by exploiting the injected script to access sensitive cookies and CSRF tokens, and by using the admin's session to perform unauthorized actions.

Reproduction

To reproduce this vulnerability, an attacker must send a WebSocket frame to an AVideo server with the YPTSocket plugin enabled. The frame must include a malicious 'page_title' parameter that contains JavaScript code. This can be done by first requesting a WebSocket token from 'getWebSocket.json.php', and then opening a WebSocket connection with the crafted 'page_title' payload. If successful, the injected script will execute in the context of any administrator currently viewing the YPTSocket debug panel.

Remediation

Users can update to AVideo version 29.0 or later, where this vulnerability has been patched.