A critical SSRF vulnerability in WWBN AVideo versions 29.0 and below allows unauthenticated attackers to bypass security controls and reach internal network endpoints.

The application utilizes an incomplete isSSRFSafeURL() validation mechanism that is susceptible to DNS rebinding attacks. This allows an unauthenticated attacker to manipulate the LiveLinks proxy to redirect HTTP requests toward sensitive internal infrastructure.

The vulnerability carries a CVSS score of 8.6, reflecting its high impact and ease of exploitability. Successful exploitation enables unauthorized access to internal services or metadata endpoints that are otherwise protected by a firewall, potentially leading to data exfiltration or further lateral movement within the environment.

Immediate Action: Update to the latest version of WWBN AVideo and ensure the fixes provided in commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 are applied.

Proactive Monitoring: Monitor server access logs for suspicious outbound requests originating from the AVideo platform, particularly those targeting internal IP ranges or local host services.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block suspicious URL parameters and restrict outbound traffic from the application server to internal network segments.

Public Exploit Available: Unknown.

Given the high severity and the availability of proof-of-concept material, organizations running WWBN AVideo must prioritize this update. Administrators should verify their current version and apply the upstream patches immediately to prevent unauthorized internal network access.