Live plugin unauth info leak: stream_key disclosure and token forgery PoC

Vulnerability Key Information Summary Vulnerability Overview Title: Unauthenticated leakage of arbitrary reStream's / : The parameter bypasses both the Live gateway and ownership verification, and the token can be derived via a public cryptographic oracle. Severity: High (CVSS 8.6 / 10) CVE: CVE-547, CVE-522, CVE-639 Affected Versions: Current version (e01e41ecc) and earlier; Fixed Versions: None Core Issue: The endpoint accepts instead of login credentials; the parameter in bypasses the ownership check, allowing an attacker to read any reStream's and without credentials. Scope of Impact An attacker only needs to know the target user's site URL (i.e., the holder of the ) and can derive the within approximately 269 requests using the public cryptographic oracle. The leaked / are streaming credentials that users hold on external platforms (YouTube, Facebook, Twitch, etc.), which can be broadcasted to that channel. The attack is an unauthenticated attack; no session or Cookie is required, only knowledge of the target site URL is needed. The success rate is approximately 3% per attempt, but the success rate can be increased through multiple attempts. Remediation Patch Core: In , strictly validate the parameter to ensure it is a legitimately signed token, rather than an arbitrary string. Specific Modifications: - Added format and signature verification for in , rejecting invalid tokens. - In , return 401 or 403 when is invalid, instead of directly returning . - Added ownership verification for , ensuring that only the reStream owner or authorized users can access it. Verification Method: Verified that the patch applies cleanly using , and tested on a local Docker instance to confirm that is no longer leaked after applying the patch. POC Code ```bash Test Environment: Local Docker instance built based on the repository's docker-compose.yml Enable the Live plugin, and create a reStream belonging to another user Control Group 1: Request without token CONTROL_1 live_restream_id=1 -> status=302 stream_key_disclosed=False CONTROL_2 token=AAAAAAAAAAAAAAAAAAAA -> status=302 stream_key_disclosed=False Derive token via public oracle === FORGING via the public oracle === 100 queries, still trying... 200 queries, still trying... forged after 269 oracle queries in 353s TARGET: anonymous, forged token = token : N4QKZ1X7A7X1A8W5F5G6H7I8J9K0L1M2N3O4P5Q6R7S8T9U0V1W2X3Y4Z5A6B7C8D9E0F1G2H3I4J5K6L7M8N9O0P1Q2R3S4T5U6V7W8X9Y0Z1A2B3C4D5E6F7G8H9I0J1K2L3M4N5O6P7Q8R9S0T1U2V3W4X5Y6Z7A8B9C0D1E2F3G4H5I6J7K8L9M0N1O2P3Q4R5S6T7U8V9W0X1Y2Z3A4B5C6D7E8F9G0H1I2J3K4L5M6N7O8P9Q0R1S2T3U4V5W6X7Y8Z9A0B1C2D3E4F5G6H7I8J9K0L1M2N3O4P5Q6R7S8T9U0V1W2X3Y4Z5A6B7C8D9E0F1G2H3I4J5K6L7M8N9O0P1Q2R3S4T5U6V7W8X9Y0Z1A2B3C4D5E6F7G8H9I0J1K2L3M4N5O6P7Q8R9S0T1U2V3W4X5Y6Z7A8B9C0D1E2F3G4H5I6J7K8L9M0N1O2P3Q4R5S6T7U8V9W0X1Y2Z3A4B5C6D7E8F9G0H1I2J3K4L5M6N7O8P9Q0R1S2T3U4V5W6X7Y8Z9A0B1C2D3E4F5G6H7I8J9K0L1M2N3O4P5Q6R7S8T9U0V1W2X3Y4Z5A6B7C8D9E0F1G2H3I4J5K6L7M8N9O0P1Q2R3S4T5U6V7W8X9Y0Z1A2B3C4D5E6F7G8H9I0J1K2L3M4N5O6P7Q8R9S0T1U2V3W4X5Y6Z7A8B9C0D1E2F3G4H5I6J7K8L9M0N1O2P3Q4R5S6T7U8V9W0X1Y2Z3A4B5C6D7E8F9G0H1I2J3K4L5M6N7O8P9Q0R1S2T3U4V5W6X7Y8Z9A0B1C2D3E4F5G6H7I8J9K0L1M2N3O4P5Q6R7S8T9U0V1W2X3Y4Z5A6B7C8D9E0F1G2H3I4J5K6L7M8N9O0P1Q2R3S4T5U6V7W8X9Y0Z1A2B3C4D5E6F7G8H9I0J1K2L3M4N5O6P7Q8R9S0T1U2V3W4X5Y6Z7A8B9C0D1E2F3G4H5I6J7K8L9M0N1O2P3Q4R5S6T7U8V9W0X1Y2Z3A4B5C6D7E8F9G0H1I2J3K4L5M6N7O8P9Q0R1S2T3U4V5W6X7Y8Z9A0B1C2D3E4F5G6H7I8J9K0L1M2N3O4P5Q6R7S8T9U0V1W2X3Y4Z5A6B7C8D9E0F1G2H3I4J5K6L7M8N9O0P1Q2R3S4T5U6V7W8X9Y0Z1A2B3C4D5E6F7G8H9I0J1K2L3M4N5O6P7Q8R9S0T1U2V3W4X5Y6Z7A8B9C0D1E2F3G4H5I6J7K8L9M0N1O2P3Q4R5S6T7U8V9W0X1Y2Z3A4B5C6D7E8F9G0H1I2J3K4L5M6N7O8P9Q0R1S2T3U4V5W6X7Y8Z9A0B1C2D3E4F5G6H7I8J9

Goal Reached Thanks to every supporter — we hit 100%!

Live plugin unauth info leak: stream_key disclosure and token forgery PoC

More from this source