AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery

MetasploitMetasploit exploitExploitRubyexploit_multi/http/avideo_notify_ffmpeg_unauth_rce

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits an unauthenticated remote code execution vulnerability in AVideo's notify.ffmpeg.json.php endpoint by discovering a predictable installation salt through information leaks and offline brute-force, then encrypting and sending a malicious payload to be evaluated by the server.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a documented exploit chain for CVE-2025-34433 against AVideo. All behavior is consistent with the described vulnerability exploitation: information gathering, salt bruteforcing, payload encryption, and sending the payload to the vulnerable endpoint. No concealed executable behavior, unrelated remote access, persistence mechanisms, credential theft, or operator-directed harm was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareAVideo
Attack typesRemote Code ExecutionCode InjectionCryptographic Weakness ExploitationInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by discovering the salt, encrypting a payload, and sending it to the target to achieve remote code execution. It includes check and exploit methods, payload generation, and session handling.

modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:10-11modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:115-148

Requirements

  • Target must be running AVideo version 14.3.1 or later but prior to 20.1.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:47-50
  • The notify.ffmpeg.json.php endpoint must be present and accessible.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:193-198
  • The categories.json.php endpoint must be accessible to leak the installation timestamp.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:121
  • A video hashId must be obtainable from videosAndroid.json.php or get.json.php.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:122

Observed behavior

  • Gathers target information including version, endpoint availability, installation timestamps, and video hashId.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:162-175
  • Performs an offline brute-force attack on the 5-character microsecond portion of the salt using the leaked timestamp and hashId.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:389-409
  • Encrypts a PHP or command shell payload using the recovered salt and system root path, then sends it to the notify.ffmpeg.json.php endpoint for server-side eval().modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:131-148modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:427-454
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain
Information gathering, salt bruteforce, payload encryption, RCE deliveryThe module follows the documented exploit chain: leak timestamps, leak hashId, bruteforce salt, encrypt payload, send to notify.ffmpeg.json.php. This is normal exploit behavior.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:35-41modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:131-148
Payload Execution
PHP or command shell payload delivered via encrypted callback parameterThe module encrypts a user-supplied payload and sends it to the target. The payload is standard Metasploit payloads (PHP in-memory, Unix/Linux command, Windows command). No hidden or unrelated payload is embedded.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:135-137modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:427-454
Author Contact
Valentin Lobstein <chocapikk[at]leakix.net>Author information is present in the module metadata. This is standard for Metasploit modules and does not indicate backdoor behavior.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:58-59
Review boundaries

What the analysis did not establish

  • Only the module source code and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded.
  • The evidence does not include any runtime output or proof of successful exploitation.
  • Review is limited to the module source file; Metasploit framework mixins, libraries, and external payloads are not included in the evidence.
  • Binary files were not inspected (none present in evidence).
  • The module's behavior depends on user-supplied payloads; the review does not assess the safety of those payloads.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

3