{"vulnerability": "cve-2025-34441", "sightings": [{"uuid": "6b5ab8b6-180c-4d82-a52d-1c85c30fc4a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34441", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb", "content": "", "creation_timestamp": "2026-01-15T23:54:26.000000Z"}, {"uuid": "63b4613b-f6f4-49b2-95a6-9dcb94e616f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34441", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mckypdty5q2f", "content": "", "creation_timestamp": "2026-01-16T21:03:03.363093Z"}, {"uuid": "2cb6fcd5-8749-4372-aff0-948fac01ea13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-34441", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated remote code execution (RCE) vulnerability\\n          in AVideo's notify.ffmpeg.json.php endpoint. The vulnerability stems from a critical\\n          cryptographic weakness in the salt generation mechanism combined with information\\n          disclosure vulnerabilities that allow an attacker to discover the encryption salt\\n          through offline bruteforce.\\n\\n          Root Cause:\\n          During installation, AVideo generates an encryption salt using PHP's uniqid() function,\\n          which is not cryptographically secure. uniqid() generates a 13-character hexadecimal\\n          string composed of: 8 characters for Unix timestamp in hex, and 5 characters for\\n          microseconds in hex (0x00000 to 0xFFFFF = 1,048,576 possible values).\\n\\n          Exploit Chain:\\n          1. Leak installation timestamp from /objects/categories.json.php (public endpoint)\\n          2. Leak video hashId from /objects/videosAndroid.json.php or /plugin/API/get.json.php\\n          3. Leak system root path from posterPortraitPath in video API responses\\n          4. Leak server timezones from /objects/getTimes.json.php\\n          5. Offline bruteforce of the remaining 5 microsecond characters using hashId comparison\\n          6. Use recovered salt to encrypt RCE payload for notify.ffmpeg.json.php eval()\\n\\n          The notify.ffmpeg.json.php endpoint uses decryptString() to decrypt the callback parameter,\\n          which has a fallback mechanism: if decryption with saltV2 (cryptographically secure) fails,\\n          it retries with the old uniqid() salt. This fallback makes the RCE exploitable.\\n\\n          Affected Versions:\\n          AVideo 14.3.1+ (introduced January 7, 2025). Requires: Fallback mechanism in\\n          encrypt_decrypt() (introduced January 15, 2024) and notify.ffmpeg.json.php with\\n          eval($callback) (introduced January 7, 2025).\\n\\n          Note on v20.0: The vendor removed the posterPortraitPath leak but did NOT remove\\n          the legacy salt fallback or eval($callback). RCE remains exploitable using SYSTEM_ROOT.\\n\\n          This vulnerability does not require authentication and can be exploited remotely by any\\n          attacker who can access the AVideo instance.\", \"disclosure_date\": \"2025-12-19\", \"fullname\": \"exploit/multi/http/avideo_notify_ffmpeg_unauth_rce\", \"is_install_path\": true, \"mod_time\": \"2026-01-08 17:03:53 +0000\", \"name\": \"AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/avideo_notify_ffmpeg_unauth_rce\", \"references\": [\"CVE-2025-34433\", \"CVE-2025-34441\", \"CVE-2025-34442\", \"URL-https://github.com/WWBN/AVideo/pull/10284\", \"URL-https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/\", \"URL-https://www.vulncheck.com/advisories/avideo-unauthenticated-rce-via-predictable-installation-salt\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic\", \"PHP In-Memory\", \"Unix/Linux Command Shell\", \"Windows Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:42.410640Z"}]}