Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in the WWBN AVideo platform allows an unauthenticated attacker to execute arbitrary JavaScript code in the browser of any connected user. This can lead to full account takeovers, session theft, and unauthorized actions performed on behalf of users, including administrators.
- Affects all users, including administrators.
- Enables universal account takeover.
- Arbitrary code execution is possible.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can inject arbitrary JavaScript into a WWBN AVideo instance, which then broadcasts to all connected users. This allows the attacker to execute code within the browser context of every user, including administrators, enabling account takeover and privileged actions.
- Target all connected users.
- No authentication required.
- Exploits `eval` sinks.
Live Threat
Current exploitation, exposure, and threat context
This critical vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of all connected users, including administrators, leading to universal account takeover and session theft. The vulnerability stems from unsanitized input in a WebSocket plugin, directly feeding into `eval()` sinks on the client side. Attackers would likely find this attractive due to the broad impact and ease of exploitation against any user of an unpatched AVideo instance.
- Exploitation is straightforward.
- No authentication is required.
- Universal session hijacking is possible.
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize isolating WWBN AVideo instances running version 29.0 or earlier due to critical remote code execution and account takeover risks. The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript on all connected clients.
- Apply patch c08694bf6264eb4decceb78c711baee2609b4efd.
- Isolate affected instances from network traffic.
- Monitor for suspicious WebSocket activity.
