FreeSWITCH mod_verto Pre-Auth Session Eviction DoS via Attacker-chosen sessid (CVE-2020-6843)

Vulnerability Overview Vulnerability Name: Pre-authentication session eviction via attacker-chosen in Vulnerability Description: The JSON-RPC handler in binds the connection to a client-provided prior to the authentication gate. The binding operation inserts the connection into the global session hash and, in the event of a key conflict, discards the existing holder of that slot, sending a message, detaching its calls, and closing its socket. An unauthenticated remote attacker, if aware of the target session UUID, can evict a legitimate client. Impact Scope Affected Versions: FreeSWITCH = 1.11.1 Impact: - Denial of Service (DoS) attack against a known verto session: the legitimate client is evicted, its calls are detached, and the WebSocket is closed. - The attacker's connection occupies the UUID slot but cannot invoke authentication methods—valid credentials are still required for subsequent login. - This is not a credential bypass or account takeover vector—the impact is limited solely to evicting existing connections. Remediation Remediation Measures: - Move the binding of to the connection to after the authentication gate within the JSON-RPC handler. Unauthenticated frames now fail the check and return before reaching the binding stage, preventing the attacker from causing eviction of another session slot. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: Low CVE ID: CVE-2020-6843 Weakness: CWE-287 Credit: Adam Bedard, Security Researcher

Goal Reached Thanks to every supporter — we hit 100%!

FreeSWITCH mod_verto Pre-Auth Session Eviction DoS via Attacker-chosen sessid (CVE-2020-6843)

More from this source