CVE-2020-37158: AVideo Platform 8.1 CSRF Vulnerability

CVE-2020-37158 Overview

AVideo Platform 8.1 contains a cross-site request forgery (CSRF) vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication. This vulnerability enables account takeover scenarios where an attacker could gain unauthorized access to user accounts on affected AVideo installations.

Critical Impact

Attackers can hijack user accounts by exploiting the CSRF vulnerability in the password recovery flow, potentially leading to unauthorized access to video content, administrative functions, and sensitive user data.

Affected Products

• AVideo Platform 8.1
• AVideo/YouPHPTube installations using vulnerable password recovery mechanism
• Self-hosted AVideo deployments without CSRF protections

Discovery Timeline

• 2026-02-11 - CVE CVE-2020-37158 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2020-37158

Vulnerability Analysis

This vulnerability is classified under CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). The core issue lies in the password recovery implementation within AVideo Platform 8.1, which fails to implement proper CSRF protections on the password reset endpoint. When a user initiates a password recovery request, the application generates a recovery token and sends it to the user's email. However, the recoverPass endpoint that processes the password change request does not validate that the request originated from the legitimate user's browser session.

The attack requires user interaction, as the victim must be tricked into clicking a malicious link or visiting a page containing the CSRF payload while authenticated or during an active password recovery session. The network-based attack vector combined with the lack of authentication requirements makes this vulnerability particularly dangerous for publicly accessible AVideo installations.

Root Cause

The root cause of this vulnerability is the absence of CSRF token validation in the password recovery mechanism. The recoverPass endpoint accepts password change requests without verifying the request origin or including anti-CSRF tokens. This design flaw allows attackers to forge requests on behalf of victims, bypassing the intended authentication flow.

Additionally, the application appears to rely solely on the recovery token for authorization, without implementing additional security measures such as:

• Same-origin policy enforcement
• Anti-CSRF tokens bound to user sessions
• Referer header validation
• Re-authentication requirements for sensitive operations

Attack Vector

The attack exploits the network-accessible password recovery endpoint through crafted HTTP requests. An attacker who obtains or predicts a valid recovery token can construct a malicious HTML page or link that, when visited by the victim, automatically submits a password change request to the vulnerable AVideo installation.

The exploitation flow typically involves:

1. The attacker identifies a target AVideo installation running version 8.1
2. The attacker crafts a malicious web page containing a hidden form or JavaScript that submits a POST request to the recoverPass endpoint
3. The victim is social-engineered into visiting the malicious page during an active password recovery session
4. The victim's browser automatically submits the forged request, changing the account password to attacker-controlled credentials
5. The attacker gains full access to the compromised account

For detailed technical information about this vulnerability, refer to the VulnCheck AVideo CSRF Advisory and Exploit-DB #48003.

Detection Methods for CVE-2020-37158

Indicators of Compromise

• Unexpected password change notifications received by users who did not initiate recovery requests
• Multiple password recovery attempts originating from unusual geographic locations or IP addresses
• Unusual patterns in web server logs showing recoverPass endpoint requests with external referer headers
• User reports of account lockouts or unauthorized access following visits to suspicious websites

Detection Strategies

• Monitor web application logs for password recovery requests that lack proper CSRF tokens or have suspicious referer headers
• Implement anomaly detection for password reset patterns, alerting on multiple resets within short timeframes
• Configure web application firewalls (WAF) to detect and block requests to sensitive endpoints with cross-origin characteristics
• Review authentication logs for successful logins following password changes that correlate with external site referrals

Monitoring Recommendations

• Enable detailed logging on the AVideo application to capture all password recovery and reset operations
• Set up alerts for password changes occurring outside normal user behavior patterns
• Monitor for HTTP requests to /recoverPass or similar endpoints from untrusted sources
• Implement session tracking to correlate password changes with user session activity

How to Mitigate CVE-2020-37158

Immediate Actions Required

• Upgrade AVideo Platform to the latest available version that includes CSRF protection fixes
• Temporarily disable the password recovery feature if an immediate patch is not available
• Implement web application firewall rules to block suspicious requests to the password recovery endpoint
• Notify users about the vulnerability and recommend they enable additional account security measures

Patch Information

Organizations running AVideo Platform 8.1 should check the GitHub Repository for AVideo for the latest security updates and patches. Review the commit history and release notes for CSRF-related fixes to the password recovery mechanism. The AVideo Official Website may also contain security advisories with specific patching instructions.

Workarounds

• Implement CSRF tokens at the reverse proxy or WAF level for the recoverPass endpoint
• Add referer header validation rules to reject password recovery requests from external origins
• Consider implementing rate limiting on password recovery endpoints to slow down potential attacks
• Deploy additional authentication factors (MFA) to reduce the impact of successful account compromise

# Example: nginx configuration to add referer validation
# Add to server block for AVideo installation
location /recoverPass {
    if ($http_referer !~ "^https?://your-avideo-domain\.com") {
        return 403;
    }
    # Existing proxy/fastcgi configuration
}