WWBN/AVideo AD_Server Missing Authorization Vulnerability (GHSA-cwtf-4qpx-4qpx)

Vulnerability Summary: Missing Authorization Vulnerability in WWBN/AVideo Overview Vulnerability ID: GHSA-cwtf-4qpx-4qpx Severity: Medium (CVSS 6.5/10) Vulnerability Type: Missing Authorization Core Issue: The endpoint, lacking authentication and CSRF protection, accepts the client-supplied parameter and invokes the method. This writes a video viewing record ( ) to the database and triggers point/balance changes in the . Trigger Conditions: With the default configuration set to , guests can trigger the vulnerability; if set to , a logged-in user is required. Scope of Impact Affected Versions: Commit and earlier versions containing the / code. Affected Entities: - Any logged-in user can repeatedly send requests to repeatedly increase the points/balance of the video owner. - The video owner can use this path to earn points from a second account. - Points can be consumed via transfers, paid content, etc. - No ad inventory is consumed. CVSS Vector: (6.5 Medium) CWE: CWE-345 (CSRF in HTTP Requests), CWE-862 (Missing Authorization). Fix Fix Version: Unfixed as of the time of reporting. Fix Commit: (commit ). Remediation Approach: 1. Add authentication and CSRF protection to . 2. Before invoking , the server should require a server-side playback acknowledgment (signed VAST callback) and should not accept from the browser as proof of playback. 3. Change the default value of to , restricting the ability to trigger rewards to logged-in users only. POC Code / Exploit Code 1. Core Vulnerability Code (log.php) 2. Reward Logic Code (VastCampaignLogs::save) 3. POC Request Example A. Guest Write (default onlyRewardLoggedUsers=false): - Sending the above POST request leaves Alice's wallet balance unchanged (i.e., guests can trigger the event, but wallet changes depend on specific configurations). B. Logged-in User (mint): - Sending the same request as , each response returns , , and , resulting in Alice's wallet balance increasing by +13.76. C. Distinction from the XSS Report: - The XSS exploit leverages HTML injection in (via ), while this vulnerability leverages to trigger playback records and wallet point changes. The code paths are distinct.

Goal Reached Thanks to every supporter — we hit 100%!

WWBN/AVideo AD_Server Missing Authorization Vulnerability (GHSA-cwtf-4qpx-4qpx)

More from this source