Attack Chain

1. An attacker identifies an AVideo instance running a vulnerable version (<= 26.0).
2. The attacker crafts a malicious URL using an IPv4-mapped IPv6 address, such as ::ffff:127.0.0.1.
3. The attacker sends an HTTP request to the plugin/LiveLinks/proxy.php endpoint, providing the malicious URL as a parameter.
4. The isSSRFSafeURL() function fails to properly validate the IPv4-mapped IPv6 address.
5. The proxy.php script uses curl (or a similar function) to fetch the content from the attacker-controlled URL.
6. The curl request is sent to the target specified within the IPv6-mapped address (e.g., localhost).
7. The attacker gains access to sensitive information from internal services, cloud metadata, or localhost.
8. The attacker may further exploit accessed services or exfiltrate data depending on the internal resources exposed.

Impact

Successful exploitation of this SSRF vulnerability allows unauthenticated attackers to read sensitive information from internal services, cloud metadata endpoints, and localhost services. This can lead to the disclosure of API keys, configuration files, internal network layouts, and potentially allow further exploitation of other internal systems. The lack of authentication on the affected endpoint greatly increases the potential for widespread abuse, particularly in cloud environments where metadata services are readily accessible.

Recommendation

• Apply the patch from commit 75ce8a579a58c9d4c7aafe453fbced002cb8f373 to remediate CVE-2026-33480.
• Monitor web server logs for requests to the plugin/LiveLinks/proxy.php endpoint containing IPv4-mapped IPv6 addresses using the provided Sigma rule.
• Implement network segmentation and firewall rules to restrict access from the AVideo server to internal resources to mitigate the impact of successful SSRF attacks.