AVideo Stored Cross-Site Scripting Vulnerability in Meet Plugin

A stored cross-site scripting vulnerability has been identified in the AVideo Meet plugin, specifically in the getMeetInfo.json.php endpoint. This vulnerability allows an anonymous, unauthenticated attacker to inject HTML/JavaScript payloads by manipulating the User-Agent header when joining public meetings. The injected payload is persisted in the meet_join_log.user_agent database field and executed in the browser session of the meeting host or site administrators when they access the Participants management panel. The vulnerability arises because the User-Agent header is stored without proper sanitization, bypassing AVideo's built-in XSS protection, and later displayed without output encoding.

Impact

Exploitation of this vulnerability allows for cross-privilege stored cross-site scripting, where an anonymous user can execute scripts in the context of an administrator or meeting host. This could lead to session hijacking, including theft of the admin session and CSRF-token exfiltration, allowing the attacker to perform any actions as the administrator.

Reproduction

To reproduce this vulnerability, first create a public meeting as an admin. Then, join the meeting as an anonymous user while sending a User-Agent header that includes a JavaScript payload. Once the payload is injected and stored, the admin or host can open the participant list, triggering the execution of the injected script in their browser session.

Remediation

The vulnerability can be fixed by encoding the User-Agent value at the point of retrieval in the getMeetInfo.json.php file, using htmlspecialchars() to ensure proper output encoding. Additionally, the User-Agent should be sanitized on write, similar to how other fields are handled, to prevent unescaped data from being stored in the first place.