A server-side request forgery vulnerability in WWBN AVideo permits attackers to bypass security filters and access sensitive internal cloud metadata and loopback interfaces.

The vulnerability resides in the isSSRFSafeURL function, which improperly validates input by failing to normalize hexadecimal-encoded NAT64 addresses. This allows an authenticated attacker to bypass existing SSRF protections and send requests to restricted internal network segments, including cloud metadata endpoints and local loopback interfaces.

The CVSS score of 7.1 underscores the risk posed by this SSRF vulnerability. By bypassing security filters, an attacker can gain unauthorized access to internal services that are otherwise protected from the internet, leading to the potential exfiltration of sensitive configuration data or cloud credentials. This poses a significant threat to the confidentiality and integrity of the hosting environment.

Immediate Action: Consult the official GitHub advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-88jm-rxg9-3v5r and apply the vendor-provided patch or update to the latest available version.

Proactive Monitoring: Review application and server access logs for requests containing unconventional address formats, such as hex-encoded IPv6 or NAT64-style addresses, which may indicate exploitation attempts.

Compensating Controls: Ensure that the AVideo application is running with the principle of least privilege, restricting its ability to communicate with internal cloud metadata services or local loopback addresses at the OS or network level.

Public Exploit Available: No

SSRF vulnerabilities are frequently used as a stepping stone for deeper network penetration. Security teams should prioritize updating the AVideo software and verify that internal network segments are properly isolated from the application tier to minimize the potential blast radius of such an attack.