A privilege escalation vulnerability in Wowza Streaming Engine 4.5.0 allows authenticated users to gain full administrative control over the application.

The application is susceptible to a privilege escalation flaw where an authenticated user with read-only access can elevate their privileges to administrator. By sending a crafted POST request to the user edit endpoint and modifying the accessLevel, advUser, and _advUser parameters, an attacker can bypass authorization controls.

Successful exploitation allows a low-privileged user to gain full administrative access, potentially leading to complete system compromise, unauthorized data access, and the ability to modify streaming configurations. Given the CVSS score of 8.8, this vulnerability poses a significant risk to the integrity and availability of the streaming infrastructure, justifying immediate attention from security teams.

Immediate Action: Since no specific patch version is provided in the current data, users should contact Wowza support to verify the latest secure version and apply all available security updates immediately.

Proactive Monitoring: Security teams should monitor server access logs for anomalous POST requests directed at the user edit interface, specifically looking for attempts to modify administrative parameters.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and filter POST requests targeting the /enginemanager/server/user/edit.htm endpoint, blocking any unauthorized attempts to set administrative flags.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the Exploit-DB entry 40133.

This vulnerability represents a high-severity risk due to the ease of privilege escalation and the potential for total administrative compromise. Organizations currently running Wowza Streaming Engine 4.5.0 must prioritize updating the software to a version that addresses this flaw and audit existing user accounts for signs of unauthorized privilege modification.