CVE-2020-37173: AVideo Platform Information Disclosure

CVE-2020-37173 Overview

CVE-2020-37173 is an information disclosure vulnerability affecting AVideo Platform 8.1 that enables attackers to enumerate user details through an insecure API endpoint. The vulnerability exists in the playlistsFromUser.json.php endpoint, which fails to properly validate authorization before returning sensitive user data. Attackers can exploit this flaw by manipulating the users_id parameter to retrieve confidential information including email addresses, password hashes, and administrative status of registered users.

This vulnerability poses significant risks to organizations using AVideo Platform, as it could enable credential theft, targeted attacks against administrators, and facilitate further compromise of the video streaming infrastructure.

Critical Impact

Unauthenticated attackers can enumerate and retrieve sensitive user credentials including password hashes and identify administrative accounts for targeted attacks.

Affected Products

• AVideo Platform 8.1
• AVideo Platform versions prior to security patch
• Self-hosted AVideo deployments with exposed API endpoints

Discovery Timeline

• 2026-02-11 - CVE CVE-2020-37173 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2020-37173

Vulnerability Analysis

This vulnerability is classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). The core issue stems from the playlistsFromUser.json.php endpoint lacking proper access controls when processing requests for user playlist information. When a request is made to this endpoint with a valid users_id parameter, the application returns a JSON response containing not only the expected playlist data but also excessive user information that should remain protected.

The vulnerability allows complete enumeration of the user database by iterating through sequential users_id values. Each successful request returns the target user's email address, hashed password, and a flag indicating whether the account has administrative privileges. This information disclosure pattern is particularly dangerous as it provides attackers with the exact data needed to conduct offline password cracking attacks or to identify high-value targets within the platform.

Root Cause

The root cause of this vulnerability is improper access control implementation in the playlistsFromUser.json.php endpoint. The application fails to verify that the requesting user has authorization to view the detailed account information of other users. Additionally, the API response includes sensitive fields (email, password hash, admin status) that should never be exposed through public-facing endpoints, regardless of authorization status. This represents both a broken access control issue and excessive data exposure in API responses.

Attack Vector

The attack is conducted over the network and requires no authentication or special privileges. An attacker simply needs to send HTTP GET requests to the vulnerable endpoint with different users_id values. The attack can be easily automated to enumerate all users in the database.

The exploitation process involves:

1. Identifying the vulnerable playlistsFromUser.json.php endpoint on the target AVideo installation
2. Sending requests with incrementing users_id parameter values starting from 1
3. Parsing the JSON responses to extract email addresses, password hashes, and admin flags
4. Compiling a database of user credentials for offline password cracking
5. Identifying administrative accounts for targeted privilege escalation attacks

For technical details on this vulnerability, refer to the Exploit-DB #47997 entry and the VulnCheck Advisory.

Detection Methods for CVE-2020-37173

Indicators of Compromise

• Unusual volume of requests to /playlistsFromUser.json.php endpoint with sequential users_id parameters
• HTTP requests to the vulnerable endpoint from external IP addresses or unexpected user agents
• Log entries showing enumeration patterns with incrementing numeric parameters
• Authentication failures following data exfiltration attempts using harvested credentials

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block sequential parameter enumeration patterns targeting the vulnerable endpoint
• Configure rate limiting on API endpoints to prevent rapid enumeration attempts
• Monitor HTTP access logs for requests to playlistsFromUser.json.php with unusual patterns or from suspicious sources
• Deploy intrusion detection signatures to identify user enumeration attack patterns

Monitoring Recommendations

• Enable detailed logging for all API endpoint access, particularly those handling user data
• Set up alerts for abnormal request volumes to user-related API endpoints
• Monitor for failed login attempts that may indicate use of harvested credentials
• Implement anomaly detection for API access patterns to identify enumeration behavior

How to Mitigate CVE-2020-37173

Immediate Actions Required

• Restrict access to the playlistsFromUser.json.php endpoint using firewall rules or web server configuration
• Implement authentication requirements for all user-related API endpoints
• Review and minimize data returned by API responses to exclude sensitive fields
• Audit user accounts for signs of compromise and force password resets if credential exposure is suspected

Patch Information

Organizations should check the AVideo GitHub Repository for the latest security updates and patches addressing this vulnerability. Apply all available security patches to AVideo Platform installations as soon as possible. Review the VulnCheck Advisory for additional remediation guidance.

Workarounds

• Implement IP-based access restrictions to limit API endpoint exposure to trusted networks only
• Deploy a reverse proxy with authentication to protect sensitive endpoints from unauthenticated access
• Modify API responses to remove sensitive user fields (email, password hash, admin status) from public endpoints
• Consider temporarily disabling the vulnerable endpoint if playlist functionality is not critical to operations

# Example nginx configuration to restrict access to vulnerable endpoint
location ~ /playlistsFromUser\.json\.php {
    # Allow only internal network access
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    # Alternatively, require authentication
    # auth_basic "Restricted Access";
    # auth_basic_user_file /etc/nginx/.htpasswd;
}