Cdn - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cdn/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 29 Jan 2024 12:00:00 +0000AVideo CDN Plugin Unauthenticated Configuration Modificationhttps://feed.craftedsignal.io/briefs/2024-01-avideo-cdn-config-vuln/Mon, 29 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-avideo-cdn-config-vuln/AVideo is vulnerable to unauthenticated configuration modification in its CDN plugin due to a bypassed key validation check when the default empty key is used, allowing modification of CDN URLs, storage credentials, and the authentication key itself.AVideo, an open source video platform, contains a critical vulnerability (CVE-2026-33719) within its CDN plugin. Versions up to and including 26.0 are affected. The vulnerability stems from the endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php using key-based authentication with an empty string as the default key. Critically, when the CDN plugin is enabled but the key remains at its default (empty) state, the authentication check is bypassed entirely. This allows any unauthenticated attacker to fully modify the CDN configuration through mass-assignment via the par request parameter. This includes the ability to manipulate CDN URLs, storage credentials, and even the authentication key itself. A patch has been released in commit adeff0a31ba04a56f411eef256139fd7ed7d4310. This is significant because it can lead to complete compromise of the video delivery infrastructure.

Attack Chain

  1. An attacker identifies an AVideo instance with the CDN plugin enabled.
  2. The attacker checks the CDN configuration by sending a GET request to plugin/CDN/status.json.php without any authentication headers to confirm if CDN plugin is enabled and running with default configuration.
  3. If the CDN key is the default empty string, the attacker crafts a malicious POST request to plugin/CDN/status.json.php or plugin/CDN/disable.json.php.
  4. The POST request includes the par parameter containing a JSON object with modified CDN settings, such as CDN URLs and storage credentials.
  5. Due to the bypassed authentication, the AVideo server processes the request and updates the CDN configuration.
  6. The attacker can modify the CDN URL to point to a malicious server hosting malware or phishing content.
  7. Legitimate users requesting video content are redirected to the attacker's malicious CDN.
  8. The attacker can also steal storage credentials and compromise the CDN's data.

Impact

Successful exploitation of CVE-2026-33719 allows an unauthenticated attacker to take complete control over the video delivery infrastructure. This can result in serving malicious content to users, data exfiltration from the CDN storage, or complete disruption of video services. The number of victims depends on the popularity of the affected AVideo instances. This vulnerability impacts any organization using AVideo with the CDN plugin enabled and the default configuration, including educational institutions, media companies, and content creators.

Recommendation

  • Apply the patch from commit adeff0a31ba04a56f411eef256139fd7ed7d4310 or upgrade to a version of AVideo that includes this fix to remediate CVE-2026-33719.
  • Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts targeting the plugin/CDN/status.json.php and plugin/CDN/disable.json.php endpoints.
  • Monitor web server logs for POST requests to plugin/CDN/status.json.php or plugin/CDN/disable.json.php endpoints without proper authentication headers, as these may indicate an attempted exploit.
  • As a temporary workaround, configure a strong, non-default key for the CDN plugin to prevent the authentication bypass.
]]>highadvisoryavideocdnconfiguration-modificationvulnerabilityOmniFaces EL Injection Vulnerability via Crafted Resource Namehttps://feed.craftedsignal.io/briefs/2024-01-omnifaces-el-injection/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-omnifaces-el-injection/A server-side EL injection vulnerability exists in OmniFaces when using CDNResourceHandler with wildcard CDN mappings, allowing attackers to inject EL expressions in resource names leading to potential remote code execution, information disclosure, or denial of service.The OmniFaces framework, a utility library for JavaServer Faces (JSF), is susceptible to EL (Expression Language) injection when the CDNResourceHandler is configured with wildcard CDN mappings. This vulnerability allows an attacker to craft a malicious resource request URL by embedding an EL expression within the resource name. This expression is then evaluated server-side, potentially leading to Remote Code Execution (RCE), information disclosure, or denial of service. The vulnerability affects OmniFaces versions before 1.14.2, versions 2.0-RC1 to 2.7.32, versions 3.0-RC1 to 3.14.16, versions 4.0-M1 to 4.7.5, and versions 5.0-M1 to 5.2.2. Applications that only use explicit resource-to-URL mappings are not affected.

Attack Chain

  1. An attacker identifies an OmniFaces application utilizing CDNResourceHandler with a wildcard CDN mapping (e.g., libraryName:*=https://cdn.example.com/*).
  2. The attacker crafts a malicious HTTP request targeting a resource served through the CDN.
  3. The crafted request includes an EL expression embedded within the resource name part of the URL, such as /javax.faces.resource/el_injection_${{...}}.js.xhtml?ln=libraryName.
  4. The CDNResourceHandler processes the request and extracts the resource name.
  5. Due to the wildcard mapping, the handler attempts to resolve the resource location based on the provided name.
  6. The EL expression within the resource name is inadvertently evaluated by the server's EL engine.
  7. Depending on the EL implementation and accessible objects, the attacker can execute arbitrary code, access sensitive information, or trigger a denial-of-service condition.
  8. The server responds to the attacker with the results of the EL expression evaluation (in case of information disclosure) or the effects of the executed code (in case of RCE).

Impact

Successful exploitation of this vulnerability can have severe consequences. In the worst-case scenario, attackers can achieve Remote Code Execution (RCE), allowing them to gain complete control over the affected server. This control enables them to install malware, steal sensitive data, or disrupt services. Even without RCE, attackers can exploit the EL injection to disclose sensitive information or cause a denial of service by exhausting server resources. The impact varies based on the specific EL implementation and the objects available within the EL context, but any application using wildcard CDN mappings in vulnerable OmniFaces versions is at risk.

Recommendation

  • Upgrade to the patched OmniFaces versions: 5.2.3, 4.7.5, 3.14.16, 2.7.32, and 1.14.2 to remediate the EL injection vulnerability as documented in the GHSA advisory.
  • Replace wildcard CDN mappings with explicit resource-to-URL mappings as a workaround if upgrading is not immediately feasible, as described in the GHSA advisory.
  • Implement a web application firewall (WAF) rule to detect and block requests containing suspicious EL expressions in the resource name part of the URL. Use the Sigma rule OmniFaces EL Injection Attempt as a starting point.
  • Monitor web server logs for unusual patterns in resource requests, specifically those containing EL-like syntax (e.g., ${...}) in the URI query, as a general indicator of potential exploitation attempts and as covered by the Sigma rule OmniFaces EL Injection URI.
]]>highadvisoryomnifacesel-injectionrcecdn