CVE-2020-37173
📋 TL;DR
AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. By manipulating the users_id parameter, attackers can retrieve sensitive user information including email, password hash, and administrative status. This affects all AVideo Platform 8.1 installations with the vulnerable endpoint accessible.
💻 Affected Systems
- AVideo Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could harvest all user credentials (including admin accounts), leading to complete system compromise, data theft, and potential lateral movement to other systems.
Likely Case
Attackers enumerate user accounts, obtain password hashes for cracking attempts, identify admin accounts for targeted attacks, and gather email addresses for phishing campaigns.
If Mitigated
With proper network segmentation and access controls, impact is limited to information disclosure of user data accessible through the vulnerable endpoint.
🎯 Exploit Status
Exploit requires simple HTTP requests to the vulnerable endpoint with manipulated parameters. Public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.2 or later
Vendor Advisory: https://github.com/WWBN/AVideo
Restart Required: No
Instructions:
1. Upgrade AVideo Platform to version 8.2 or later. 2. Verify the playlistsFromUser.json.php endpoint no longer discloses sensitive user information. 3. Consider resetting user passwords as a precaution.
🔧 Temporary Workarounds
Block vulnerable endpoint
allRestrict access to the playlistsFromUser.json.php endpoint using web server configuration or firewall rules.
# Apache: RewriteRule ^/plugin/API/playlistsFromUser.json.php - [F]
# Nginx: location ~ /plugin/API/playlistsFromUser.json.php { deny all; }
Implement authentication requirement
allModify the endpoint to require valid authentication before returning any user data.
# Modify playlistsFromUser.json.php to check user session before processing
🧯 If You Can't Patch
- Implement network segmentation to restrict access to AVideo Platform from untrusted networks.
- Deploy a web application firewall (WAF) with rules to block requests to the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Send a GET request to /plugin/API/playlistsFromUser.json.php?users_id=1 and check if sensitive user information (email, password hash) is returned in the response.Check Version:
Check AVideo version in admin panel or examine version files in installation directory.Verify Fix Applied:
After patching, repeat the vulnerable check. The endpoint should return an error or no sensitive data when accessing user information.📡 Detection & Monitoring
Log Indicators:
- Multiple requests to playlistsFromUser.json.php with different users_id parameters
- Unusual access patterns to user data endpoints
Network Indicators:
- HTTP requests to /plugin/API/playlistsFromUser.json.php with parameter manipulation
- Burst of requests to user enumeration endpoints
SIEM Query:
source="web_logs" AND uri="/plugin/API/playlistsFromUser.json.php" AND (param="users_id" OR query_contains="users_id")