A critical security flaw in WWBN AVideo allows unauthenticated remote code execution due to improper file type filtering in the .htaccess configuration.

The application employs an insufficient blacklist within its .htaccess sample, which fails to prevent the execution of malicious files. This allows an unauthenticated attacker to upload or request a .phar file to achieve remote code execution on the underlying server.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code with the privileges of the web server. This could lead to a complete compromise of the application, unauthorized access to sensitive data, or the use of the server as a pivot point for further network infiltration. Given the CVSS score of 7.3, this represents a significant risk to organizational integrity and data confidentiality.

Immediate Action: Restrict access to the .htaccess configuration and ensure that all executable file extensions, including .phar, are explicitly blocked from direct execution.

Proactive Monitoring: Audit web server access logs for requests targeting .phar files or unusual patterns indicative of directory traversal and file execution attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests that contain suspicious file extensions or attempt to access restricted server-side file types.

Public Exploit Available: No

The presence of this vulnerability in a public-facing component necessitates immediate attention. Administrators must verify their current version and apply restrictive configuration changes to the .htaccess file to mitigate the risk of arbitrary code execution. Given the ease of exploitation, prioritizing this remediation is essential to prevent potential system-wide compromise.