AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery

Description

This module exploits an unauthenticated remote code execution (RCE) vulnerability in AVideo's notify.ffmpeg.json.php endpoint. The vulnerability stems from a critical cryptographic weakness in the salt generation mechanism combined with information disclosure vulnerabilities that allow an attacker to discover the encryption salt through offline bruteforce.

Root Cause: During installation, AVideo generates an encryption salt using PHP's uniqid() function, which is not cryptographically secure. uniqid() generates a 13-character hexadecimal string composed of: 8 characters for Unix timestamp in hex, and 5 characters for microseconds in hex (0x00000 to 0xFFFFF = 1,048,576 possible values).

Exploit Chain: 1. Leak installation timestamp from /objects/categories.json.php (public endpoint) 2. Leak video hashId from /objects/videosAndroid.json.php or /plugin/API/get.json.php 3. Leak system root path from posterPortraitPath in video API responses 4. Leak server timezones from /objects/getTimes.json.php 5. Offline bruteforce of the remaining 5 microsecond characters using hashId comparison 6. Use recovered salt to encrypt RCE payload for notify.ffmpeg.json.php eval()

The notify.ffmpeg.json.php endpoint uses decryptString() to decrypt the callback parameter, which has a fallback mechanism: if decryption with saltV2 (cryptographically secure) fails, it retries with the old uniqid() salt. This fallback makes the RCE exploitable.

Affected Versions: AVideo 14.3.1+ (introduced January 7, 2025). Requires: Fallback mechanism in encrypt_decrypt() (introduced January 15, 2024) and notify.ffmpeg.json.php with eval($callback) (introduced January 7, 2025).

Note on v20.0: The vendor removed the posterPortraitPath leak but did NOT remove the legacy salt fallback or eval($callback). RCE remains exploitable using SYSTEM_ROOT.

This vulnerability does not require authentication and can be exploited remotely by any attacker who can access the AVideo instance.