A server-side request forgery vulnerability in WWBN AVideo versions prior to 22.0 allows authenticated attackers to perform unauthorized requests against internal network infrastructure.

The aVideoEncoder.json.php API endpoint fails to properly validate the downloadURL parameter, allowing an authenticated user to force the server to initiate requests to arbitrary internal endpoints. This SSRF flaw facilitates unauthorized interaction with internal services or metadata APIs that are otherwise inaccessible from the public internet.

Successful exploitation allows an attacker to bypass network perimeters and interact with internal-only services. With a CVSS score of 8.1, this vulnerability poses a significant risk of data exfiltration or potential privilege escalation within the internal network, which could lead to a broader compromise of the organizational infrastructure.

Immediate Action: Update the AVideo platform to version 22.0 or later immediately to incorporate the necessary input validation and allow-list protections.

Proactive Monitoring: Monitor server access logs for anomalous outgoing requests originating from the AVideo server, particularly those targeting internal IP ranges or local metadata services.

Compensating Controls: Implement strict egress filtering on the host running AVideo to prevent the server from initiating connections to sensitive internal network segments or unauthorized external domains.

Public Exploit Available: No (exploit_available unknown)

Given the High severity rating of this vulnerability and the potential for internal network exposure, administrators must prioritize the update to version 22.0. Organizations failing to update should treat the AVideo application as an untrusted asset and isolate it from sensitive internal resources until the patch is successfully applied.