GHSA-8qm8-g55h-xmqr WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators

• Packagist wwbn/avideo: <= 29.0 (no fix yet)

Summary `objects/commentDelete.json.php` is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call `forbidIfIsUntrustedRequest()`, does not verify a CSRF/global token, and does not check `Origin`/`Referer`. Because AVideo intentionally sets `session.cookie_samesite=None` (to support cross-origin embed players), a cross-site request from any attacker-controlled page automatically carries the victim's `PHPSESSID`. Any authenticated victim who has authority to delete one or more comments (site moderators, video owners, and comment authors) can be tricked into deleting comments en masse simply by visiting an attacker page. Details Vulnerable endpoint: `objects/commentDelete.json.php` ```php // objects/commentDelete.json.php:1-35 error = true; $obj->msg = ''; $obj->id = intval(@$_REQUEST['id']); // status = false; if (empty($obj->id)) { $obj->id = intval(@$_REQUEST['comments_id']); } if (empty($obj->id)) { $obj->msg = __("ID can not be empty"); die(_json_encode($obj)); } $objC = new Comment("", 0, $obj->id); $obj->videos_id = $objC->getVideos_id(); $obj->status = $objC->delete(); // `) or `POST` (e.g. via an auto-submitting form / `fetch`). Authorization inside `Comment::delete()` does not stop CSRF ```php // objects/comment.php:147-159 public function delete() { if (!self::userCanAdminComment($this->id)) { return false; } ... $sql = "DELETE FROM comments WHERE id = ?"; ... return sqlDAL::writeSql($sql, "i", [$this->id]); } // objects/comment.php:316-332 public static function userCanAdminComment($comments_id) { if (!User::isLogged()) { return false; } if (Permissions::canAdminComment()) { return true; } // site moderator $obj = new Comment("", 0, $comments_id); if ($obj->users_id == User::getId()) { return true; } // comment owner $video = new Video("", "", $obj->videos_id); if ($video->getUsers_id() == User::getId()) { return true; } // video owner return false; } ``` This check is exactly what CSRF abuses: it asks "is the session user allowed to delete this comment?" In a CSRF attack, the session user is the victim, and yes — the victim is allowed. So the check grants the request. Site-wide cookie policy makes cross-site delivery reliable ```php // objects/include_config.php:139-146 if ($isHTTPS) { // SameSite=None is intentional: AVideo supports cross-origin iframe embedding // where users must stay authenticated (e.g. video players on third-party sites). // Setting Lax would break that use case. All state-mutating endpoints that are // vulnerable to CSRF must instead enforce a short-lived globalToken (verifyToken). ini_set('session.cookie_samesite', 'None'); ini_set('session.cookie_secure', '1'); } ``` The in-source comment is explicit: because AVideo intentionally opts out of SameSite protection, every state-mutating endpoint is responsible for its own CSRF defense. `commentDelete.json.php` forgets to apply it. The canonical example that does get it right is `objects/userUpdate.json.php:18`: ```php // objects/userUpdate.json.php:13-18 if (!User::isLogged()) { $obj->msg = __("Is not logged"); die(json_encode($obj)); } forbidIfIsUntrustedRequest(); // Cute kittens for (let i = 1; i ``` Manual verification of the server-side handler with the victim's own cookie (demonstrates that the endpoint itself performs the delete with no token): ```bash 1. Log in as a moderator and capture PHPSESSID curl -c cookies.txt -d 'user=moderator&pass=pass' \ https://victim.example.com/objects/userLogin.json.php 2. Call the endpoint with nothing but the session cookie and a comments_id. No CSRF token, no Referer/Origin matching the site. curl -b cookies.txt \ -H 'Origin: https://attacker.example' \ -H 'Referer: https://attacker.example/mass-delete.html' \ 'https://victim.example.com/objects/commentDelete.json.php?comments_id=1' -> {"error":false,"msg":"","id":1,"status":true,"videos_id":...} ``` The `{"status":true,"error":false}` response confirms the row was deleted; compare with `objects/userUpdate.json.php` under the same Origin/Referer, which returns the "Invalid Request" forbidden page from `forbidIfIsUntrustedRequest()`. Impact • Cross-site mass deletion of comments. • Against a site moderator (`Permissions::canAdminComment()`), the attacker can permanently delete every comment on the platform — a severe content-integrity and availability hit on the community layer. • Against any channel owner, the attacker can wipe all discussion under that creator's videos, a targeted reputation / engagement attack (e.g., silence dissent, silence evidence of prior posts). • The attack only requires luring a logged-in victim to any page that can fetch/embed/submit — a forum post, a compromised ad, a link in email, a rogue embed. • No credential compromise is required; the attack does not leak data, but it destroys it. • Because SameSite=None is a deliberate, documented product decision, browser-side defenses do not intervene. Recommended Fix Apply the project's own prescribed CSRF pattern to the handler. Two layers are appropriate: 1. Require an authenticated session and reject untrusted-origin requests (same treatment as `userUpdate.json.php`). 2. Restrict the method to `POST` so drive-by `` and navigational `GET` deliveries cannot reach the sink. ```php // objects/commentDelete.json.php <?php header('Content-Type: application/json'); global $global, $config; if (!isset($global['systemRootPath'])) { require_once '../videos/configuration.php'; } require_once $global['systemRootPath'] . 'objects/comment.php'; // --- added CSRF defense --- if (!User::…