ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/upload.php where the user supplied input via collection get parameter is directly provided to unserialize function. As a result, it is possible for an adversary to inject maliciously crafted PHP serialized object and utilize gadget chains to cause unexpected behaviors of the application. This vulnerability is fixed in 5.5.1 Revision 200.
In the upload/upload.php file, the value of a GET parameter named 'collection' is passed directly to the unserialize() function without any validation or filtering. An attacker can provide a maliciously crafted serialized PHP object as the value of this parameter. Using so-called gadget chains — chains of existing classes and methods in the application or its dependencies — it is possible to trigger unforeseen application behavior, including execution of arbitrary code on the server side.
An unauthenticated attacker can remotely execute arbitrary code on the server (RCE), leading to complete takeover of the application, disclosure of sensitive data, and violation of system integrity and availability.
ClipBucket V5 should be updated to version 5.5.1 Revision 200, in which the vulnerability has been patched. The patch is available in the project repository on GitHub (commit 76a829c088f0813ab3244a3bd0036111017409b0).
ClipBucket V5 (ClipBucket-v5) version 5.5.1 Revision 199 and all earlier versions
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOxygenz Clipbucket
APPOxygenz5.5.1-141 – 5.5.1-200 (bez)
Related vulnerabilities
TOCTOU Race Condition w ClipBucket umożliwia wykonanie kodu PHP
Blind SQL Injection w ClipBucket v5 — sekcja komentarzy kanału
ClipBucket 5.5.2 — hardcoded domyślne dane logowania w panelu admina
ClipBucket V5 — nieograniczony upload plików PHP przez funkcję playlist
PHP Deserialization w ClipBucket V5 — zdalne wykonanie kodu