AVideo OS Command Injection Vulnerability in FFmpeg Process Management

A command injection vulnerability has been identified in AVideo versions through 29.0. The issue resides in the 'plugin/API/standAlone/functions.php' file, specifically within the 'listFFmpegProcesses()' function. This function improperly handles keyword parameters by interpolating them into a shell command without proper sanitization or escaping. As a result, attackers can craft encrypted payloads to break out of the single-quoted context and execute arbitrary commands on the server as the web server user.

Impact

Exploitation of this vulnerability allows for arbitrary operating system command execution on the server where AVideo is hosted, under the privileges of the web server user. This could lead to unauthorized access to application files, database credentials, and the ability to modify site data or persistently compromise the application.

Reproduction

The vulnerability can be reproduced by sending a POST request to 'plugin/API/standAlone/ffmpeg.json.php' with a crafted 'codeToExec' payload that includes a command injection vector, such as closing the quote and appending a command after a comment symbol. This payload must be encrypted and sent along with a valid 'APISecret'. The injection can be verified by checking for the execution of the injected command, such as creating a file in the '/tmp' directory.

Remediation

To address this vulnerability, the 'listFFmpegProcesses()' function should be modified to escape the keyword parameter using 'escapeshellarg()' before interpolating it into the command. Alternatively, the calling functions can be updated to pass a sanitized keyword value instead of the raw decrypted one.