WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF

QFinch assessment

The incomplete SSRF fix in AVideo's LiveLinks proxy adds isSSRFSafeURL() validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints.

Potential impact

DNS rebinding allows an attacker to bypass SSRF validation and make the server send requests to internal services, cloud metadata endpoints, and other protected resources.

Technical context

The plugin/LiveLinks/proxy.php endpoint proxies live stream URLs. The fix adds isSSRFSafeURL() check on the initial URL, redirect URL validation, and followlocation=0 in the getheaders() context. However, multiple DNS TOCTOU vulnerabilities remain. For the initial URL, isSSRFSafeURL() resolves DNS once for validation, but getheaders() resolves DNS again independently. A DNS rebinding attack with TTL=0 returns a safe external IP for the first resolution and an internal IP for the second. The same TOCTOU exists for redirect URLs: isSSRFSafeURL() validates the redirect target (first resolution returns a safe IP), then fakeBrowser() makes the actual request (second resolution returns an internal IP). Additionally, even with followlocation=0, getheaders() still sends an HTTP request that can probe internal services via DNS rebinding, and multiple Location headers in a response cause filtervar() to receive an array instead of a string, resulting in a fall-through to the else branch.