CVE-2026-33351: WWBN AVideo SSRF Vulnerability

CVE-2026-33351 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in WWBN AVideo, an open source video platform. The vulnerability exists in the plugin/Live/standAloneFiles/saveDVR.json.php file when the AVideo Live plugin is deployed in standalone mode. The $_REQUEST['webSiteRootURL'] parameter is used directly to construct a URL that is fetched server-side via file_get_contents() without any authentication, origin validation, or URL allowlisting.

Critical Impact
This SSRF vulnerability allows unauthenticated attackers to make arbitrary HTTP requests from the server, potentially accessing internal services, cloud metadata endpoints, and sensitive internal resources without any authentication requirements.

Affected Products

WWBN AVideo versions prior to 26.0
AVideo Live plugin in standalone mode
Systems using plugin/Live/standAloneFiles/saveDVR.json.php

Discovery Timeline

2026-03-23 - CVE-2026-33351 published to NVD
2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33351

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The flaw allows attackers to manipulate the server into making HTTP requests to arbitrary destinations. When the AVideo Live plugin operates in standalone mode, the endpoint at saveDVR.json.php accepts user-controlled input through the $_REQUEST['webSiteRootURL'] parameter. This input is then used to construct a URL that the server fetches using PHP's file_get_contents() function.

The lack of input validation, authentication, and URL allowlisting creates a dangerous attack surface where remote attackers can force the vulnerable server to make requests to internal network resources, cloud infrastructure metadata services (such as AWS EC2 metadata at 169.254.169.254), or other sensitive endpoints that should not be externally accessible.

Root Cause

The root cause of this vulnerability lies in the direct use of user-supplied input ($_REQUEST['webSiteRootURL']) to construct URLs for server-side requests without implementing proper security controls. The file_get_contents() function is called with an attacker-controlled URL, enabling SSRF attacks. The absence of authentication on this endpoint compounds the issue, as any remote attacker can trigger the vulnerability without credentials.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests to the vulnerable endpoint, supplying a specially crafted webSiteRootURL parameter value. This parameter value can point to internal services, localhost endpoints, cloud metadata services, or other sensitive resources that the server can access from its network position.

The vulnerability is particularly dangerous in cloud environments where attackers could potentially access instance metadata services to retrieve credentials, or in environments where the AVideo server has access to internal services that are not exposed to the internet.

Detection Methods for CVE-2026-33351

Indicators of Compromise

Unusual outbound HTTP requests from the AVideo server to internal IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
Requests to cloud metadata endpoints (169.254.169.254)
Suspicious access patterns to plugin/Live/standAloneFiles/saveDVR.json.php with unusual webSiteRootURL parameter values
Unexpected network connections from the web server to localhost services

Detection Strategies

Monitor web server logs for requests to saveDVR.json.php containing suspicious URL patterns in the webSiteRootURL parameter
Implement network monitoring to detect outbound connections from the web server to internal IP ranges or cloud metadata services
Configure web application firewall (WAF) rules to detect and block SSRF attack patterns targeting the vulnerable endpoint
Review application logs for file_get_contents() errors that may indicate failed SSRF attempts

Monitoring Recommendations

Enable verbose logging on the AVideo application to capture all requests to the Live plugin endpoints
Deploy network segmentation alerts to detect when the web server attempts to access restricted internal networks
Configure egress filtering alerts for the web server to detect connections to unusual destinations
Implement real-time alerting for access to known sensitive endpoints like cloud metadata services

How to Mitigate CVE-2026-33351

Immediate Actions Required

Upgrade WWBN AVideo to version 26.0 or later immediately
If immediate upgrade is not possible, restrict access to the plugin/Live/standAloneFiles/saveDVR.json.php endpoint at the web server level
Implement network-level egress filtering to prevent the server from accessing internal resources or cloud metadata endpoints
Review server logs for signs of prior exploitation

Patch Information

WWBN has released version 26.0 of AVideo which contains a patch for this vulnerability. The fix is available in the GitHub commit d0c54960389eeb85e76caed5a257ae90e6a739f2. Organizations should upgrade to version 26.0 or apply the specific commit to address this vulnerability. Additional details are available in the GitHub Security Advisory GHSA-5f7v-4f6g-74rj.

Workarounds

Block access to plugin/Live/standAloneFiles/saveDVR.json.php using web server configuration if the Live plugin standalone mode is not required
Implement a web application firewall (WAF) rule to validate and restrict the webSiteRootURL parameter to known-safe domains
Configure network-level egress filtering to prevent the web server from initiating connections to internal networks and cloud metadata services
Apply authentication requirements to the vulnerable endpoint using .htaccess or equivalent web server configuration

bash

# Apache configuration to restrict access to the vulnerable endpoint
<Location "/plugin/Live/standAloneFiles/saveDVR.json.php">
    Require all denied
</Location>