CyberRota Analysis
AI-GeneratedAVideo versions from a specific commit through the latest master are vulnerable to a server-side request forgery (SSRF) due to inadequate DNS pinning validation in the encoder download-by-URL feature. This flaw allows authenticated attackers to manipulate the download URL, potentially redirecting requests to internal resources and enabling blind SSRF attacks. Organizations using AVideo should prioritize patching this vulnerability to protect their internal systems from unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks.