CVE-2026-33294: Wwbn Avideo SSRF Vulnerability

CVE-2026-33294 Overview

CVE-2026-33294 is a Server-Side Request Forgery (SSRF) vulnerability affecting WWBN AVideo, an open source video platform. The vulnerability exists in the BulkEmbed plugin's save endpoint (plugin/BulkEmbed/save.json.php), which fetches user-supplied thumbnail URLs via url_get_contents() without implementing SSRF protection. While six other URL-fetching endpoints in AVideo were hardened with isSSRFSafeURL(), this particular code path was overlooked, allowing authenticated attackers to force the server to make HTTP requests to internal network resources and retrieve responses by viewing saved video thumbnails.

Critical Impact

Authenticated attackers can leverage this SSRF vulnerability to access internal network resources, potentially exposing sensitive services, cloud metadata endpoints, and internal APIs that should not be accessible from the internet.

Affected Products

• WWBN AVideo versions prior to 26.0
• AVideo BulkEmbed plugin (all versions before the fix)
• Self-hosted AVideo installations with BulkEmbed plugin enabled

Discovery Timeline

• 2026-03-22 - CVE-2026-33294 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33294

Vulnerability Analysis

This vulnerability is classified under CWE-918 (Server-Side Request Forgery). The root issue stems from inconsistent security controls applied across the AVideo codebase. During a security hardening effort, the development team implemented SSRF protection using isSSRFSafeURL() across six URL-fetching endpoints throughout the application. However, the BulkEmbed plugin's save endpoint at plugin/BulkEmbed/save.json.php was missed during this process.

The vulnerability requires authentication to exploit, limiting the attack surface to users with valid credentials on the AVideo platform. Once authenticated, an attacker can supply arbitrary URLs as thumbnail values, causing the server to fetch content from those URLs using the url_get_contents() function without any validation or filtering.

Root Cause

The root cause is a missing security check in the BulkEmbed plugin's save functionality. While the application maintains a security function isSSRFSafeURL() specifically designed to prevent SSRF attacks, this validation was not applied to the thumbnail URL parameter in the save.json.php endpoint. This inconsistency in applying security controls across the codebase allowed the SSRF vulnerability to exist despite other endpoints being properly protected.

Attack Vector

The attack vector requires network access and authenticated user privileges. An attacker with valid credentials can exploit this vulnerability by:

1. Authenticating to the AVideo platform with any valid user account
2. Accessing the BulkEmbed plugin's save functionality
3. Supplying a malicious URL pointing to internal network resources as the thumbnail parameter
4. The server fetches the content from the attacker-specified URL without validation
5. The attacker retrieves the internal resource content by viewing the saved video thumbnail

This allows reconnaissance of internal networks, access to cloud metadata services (such as AWS IMDSv1 at http://169.254.169.254/), and interaction with internal APIs that trust requests from the server's IP address.

The vulnerability mechanism involves the url_get_contents() function processing user-supplied thumbnail URLs without the isSSRFSafeURL() validation that protects other endpoints. For technical details, see the GitHub Security Advisory GHSA-66cw-h2mj-j39p.

Detection Methods for CVE-2026-33294

Indicators of Compromise

• Unusual outbound HTTP requests from the AVideo server to internal IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints (e.g., 169.254.169.254) originating from the AVideo application
• Suspicious thumbnail URLs containing internal hostnames or IP addresses in the database
• HTTP requests to localhost or loopback addresses from the BulkEmbed save endpoint

Detection Strategies

• Monitor web application logs for requests to plugin/BulkEmbed/save.json.php containing internal IP addresses or suspicious URL patterns
• Implement network-level monitoring to detect outbound connections from the AVideo server to RFC1918 address space
• Review application logs for failed or unusual URL fetch attempts that may indicate SSRF probing
• Deploy Web Application Firewall (WAF) rules to detect SSRF payloads in thumbnail URL parameters

Monitoring Recommendations

• Enable detailed logging for all URL-fetching operations in the AVideo application
• Set up alerts for any outbound connections from the web server to internal network segments
• Monitor for access patterns consistent with internal network enumeration or metadata service access
• Implement egress filtering to restrict the AVideo server's ability to connect to internal resources

How to Mitigate CVE-2026-33294

Immediate Actions Required

• Upgrade WWBN AVideo to version 26.0 or later immediately
• If immediate upgrade is not possible, disable the BulkEmbed plugin until patching can be completed
• Review application logs for any evidence of exploitation attempts
• Audit existing thumbnail URLs in the database for signs of SSRF attacks

Patch Information

WWBN has released version 26.0 which addresses this vulnerability by applying the isSSRFSafeURL() validation to the BulkEmbed plugin's save endpoint. The fix ensures consistent SSRF protection across all URL-fetching endpoints in the application. The specific commit addressing this issue is available at the GitHub Commit Changes. Additional details can be found in the GitHub Security Advisory GHSA-66cw-h2mj-j39p.

Workarounds

• Disable the BulkEmbed plugin if not required for operations until the patch can be applied
• Implement network-level egress filtering to prevent the AVideo server from connecting to internal network ranges
• Deploy a reverse proxy or WAF rule to filter requests containing internal IP addresses in thumbnail parameters
• Restrict authentication to trusted users only until the vulnerability is patched

# Example: Network-level mitigation using iptables to block internal network access
# Block outbound connections to RFC1918 private address ranges from web server
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner www-data -j DROP