GHSA-x3pr-vrhq-vq43 AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration

• Packagist wwbn/avideo: <= 26.0 (no fix yet)

Summary AVideo's `_session_start()` function accepts arbitrary session IDs via the `PHPSESSID` GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in `User::login()`, this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session. Details The vulnerability is a chain of three weaknesses that together enable session fixation: 1. Attacker-controlled session ID acceptance (`objects/functionsPHP.php:344-367`) ```php function _session_start(array $options = []) { // ... if (isset($_GET['PHPSESSID']) && !_empty($_GET['PHPSESSID'])) { $PHPSESSID = $_GET['PHPSESSID']; // ... if (!User::isLogged()) { if ($PHPSESSID !== session_id()) { _session_write_close(); session_id($PHPSESSID); // phpsessid = session_id()`) • `view/js/session.js` stores the session ID in a global `window.PHPSESSID` variable and logs it to console (line 15) • No session-to-IP or session-to-user-agent binding exists (verified via codebase search) PoC Step 1: Attacker obtains a session ID ```bash Attacker visits the site to get a valid session ID curl -v https://target.example.com/ 2>&1 | grep 'set-cookie.*PHPSESSID' Response: Set-Cookie: PHPSESSID=attacker_known_session_id; ... ``` Step 2: Attacker injects a link on the platform The attacker posts a comment on a video or creates content containing a link: ``` https://target.example.com/objects/getCaptcha.php?PHPSESSID=attacker_known_session_id ``` This can be placed in a video comment, video description, user bio, or forum post — anywhere AVideo renders user-provided links. Step 3: Victim clicks the link while browsing AVideo When the victim clicks the link from within the AVideo platform: 1. Browser sets `Referer: https://target.example.com/...` (same-domain) 2. `_session_start()` processes `$_GET['PHPSESSID']`, victim is not logged in, so `session_id('attacker_known_session_id')` is called 3. `blackListRegenerateSession()` returns `true` (script is `getCaptcha.php` + same-domain Referer) 4. `_session_regenerate_id()` is skipped 5. Victim's session is now fixed to `attacker_known_session_id` Step 4: Victim logs in The victim navigates to the login page and authenticates. `User::login()` populates `$_SESSION['user']` but does NOT regenerate the session ID (line 1317 is commented out). Step 5: Attacker hijacks the authenticated session ```bash Attacker uses the known session ID to access victim's account curl -b "PHPSESSID=attacker_known_session_id" https://target.example.com/objects/user.php?userAPI=1 Response: victim's user data, confirming session hijack ``` Impact • Full account takeover: An attacker can hijack any user's authenticated session, including administrator accounts • Data access: Full access to the victim's videos, private content, messages, and personal information • Privilege escalation: If the victim is an admin, the attacker gains full administrative control over the AVideo instance • Lateral actions: The attacker can perform any action as the victim — upload/delete content, modify settings, access admin panel Recommended Fix Fix 1: Re-enable session regeneration on login (`objects/user.php:1317`) ```php // Replace the commented-out line: //_session_regenerate_id(); // With: _session_regenerate_id(); ``` This is the most critical fix. Session regeneration on authentication transition is a fundamental defense against session fixation (OWASP recommendation). Fix 2: Remove GET-based session ID acceptance (`objects/functionsPHP.php:344-383`) Remove or restrict the `$_GET['PHPSESSID']` handling entirely. If it is needed for specific use cases (e.g., CAPTCHA), validate the session ID against a server-side token rather than blindly accepting arbitrary values: ```php // Instead of accepting any GET PHPSESSID, remove this block entirely. // If CAPTCHA requires session continuity, pass a CSRF token instead. if (isset($_GET['PHPSESSID']) && !_empty($_GET['PHPSESSID'])) { // REMOVED: Do not accept session IDs from URL parameters } ``` Fix 3: Remove session ID exposure (`objects/phpsessionid.json.php`, `view/js/session.js`) The `phpsessionid.json.php` endpoint and the `session.js` global variable negate the `httponly` cookie flag. If JavaScript needs to reference the session for AJAX requests, the browser automatically includes session cookies — there is no need to expose the session ID value to JavaScript.