AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php
Summary
The plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.
Details
The entire file at plugin/CloneSite/client.log.php:
<?php
include '../../videos/cache/clones/client.log';No authentication check. The log file is populated by cloneClient.json.php which writes operational details during clone operations:
// plugin/CloneSite/cloneClient.json.php:118
$log->add("Clone (2 of {$totalSteps}): Geting MySQL Dump file [$cmd]");The $cmd variable contains wget commands with internal filesystem paths, and rsync command templates with SSH connection details (username, IP, port).
Compare with sibling endpoints:
plugin/CloneSite/index.phpchecksUser::isAdmin()plugin/CloneSite/changeStatus.json.phpchecksUser::isAdmin()plugin/CloneSite/clones.json.phpchecksUser::isAdmin()plugin/CloneSite/delete.json.phpchecksUser::isAdmin()
Proof of Concept
curl "https://your-avideo-instance.com/plugin/CloneSite/client.log.php"If the CloneSite feature has been used, the response contains wget commands, filesystem paths, SSH metadata, and SQL dump file locations.
Impact
Unauthenticated disclosure of internal infrastructure details that could aid targeted attacks against the clone source server.
Recommended Fix
Add an admin authentication check at plugin/CloneSite/client.log.php, before the include:
require_once '../../videos/configuration.php';
if (!User::isAdmin()) {
http_response_code(403);
die('Access denied');
}Found by aisafe.io
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | wwbn/avideo | <= 26.0 | sin corrección |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Debilidad (CWE)
CWE-200- Plataforma
- Composer
- Paquete
wwbn/avideo- Publicada
- 04.04.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-99j6-hj87-6fcf - CC BY 4.0
Historial de vulnerabilidades: wwbn/avideo
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 160
- Primera → última
- 04.2022 06.2026
- Sin corrección
- 143
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 14
- Alta 61
- Media 83
- Baja 2
Divulgaciones por año
- 2022: 2
- 2023: 5
- 2024: 5
- 2025: 0
- 2026: 148
-
AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.