A critical OS command injection vulnerability in the AVideo CloneSite plugin allows unauthenticated remote attackers to achieve full system compromise by leveraging CSRF to inject malicious payloads.

This vulnerability occurs in the CloneSite plugin where an SSH password field fails to sanitize input, leading to OS command injection via the sshpass utility. An unauthenticated attacker can trick an authenticated administrator into saving a malicious payload using CSRF, which is then executed by the system crontab with elevated privileges.

The exploitation of this vulnerability grants an attacker the ability to execute arbitrary code with the privileges of the crontab owner, which is frequently root or the web server user. This level of access facilitates complete system takeover, data exfiltration, and lateral movement within the network. With a CVSS score of 8.8, this flaw represents a significant risk to the confidentiality, integrity, and availability of the host environment.

Immediate Action: Since no official patch is currently available, administrators should immediately disable the CloneSite plugin and remove any associated crontab entries to prevent execution of injected commands.

Proactive Monitoring: Review web server logs for suspicious POST requests targeting objects/pluginAddDataObject.json.php and monitor system crontab files for unauthorized modifications or unexpected tasks.

Compensating Controls: Ensure $global['trustedProxies'] is correctly configured to prevent bypass of CSRF protections and implement strict SameSite cookie policies to mitigate cross-site request forgery attempts.

Public Exploit Available: No (exploit_available: unknown)

Given the severity of this remote code execution vulnerability and the lack of a vendor-provided patch, organizations must prioritize the immediate deactivation of the CloneSite plugin. Administrators should perform a thorough audit of their AVideo installations to ensure no malicious passwords or clone site URLs have already been injected, as the persistence of this flaw allows for delayed execution via scheduled tasks.