AVideo OS Command Injection Vulnerability in FFmpeg JSON Endpoint

A command injection vulnerability has been identified in AVideo versions through 29.0, specifically within the FFmpeg JSON endpoint. The issue arises because the notifyCode and callback parameters are concatenated into a shell command without proper escaping. This flaw allows attackers who can create a valid encrypted payload to inject arbitrary shell metacharacters, executing OS commands as the web server user.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the AVideo host, as the web server user. This user has access to application files, configuration, and database credentials, enabling an attacker to read and modify site data, access the database, and establish persistence.

Reproduction

The vulnerability can be reproduced by sending a POST request to the FFmpeg JSON endpoint with an encrypted 'codeToExec' payload that includes a crafted 'notifyCode' or 'callback' parameter. The injected command will be executed on the server, demonstrating the command injection flaw.

Remediation

To address this vulnerability, both the 'notifyCode' and 'callback' fields should be escaped using 'escapeshellarg()', similar to the existing 'notify' parameter. Alternatively, these fields could be routed through the same allowlist/denylist used for 'ffmpegCommand' to ensure proper sanitization.