coturn MOBILITY-TICKET Authorization Bypass allowing TURN Allocation Takeover (CVE-2020-6581)

Vulnerability Overview Vulnerability Name: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover Vulnerability Description: When the coturn server is started with the non-default (MICE) option, an attacker possessing valid long-term credentials for a victim can take over the victim's active TURN allocation. The session resume path in validates that the resume request corresponds to the attacker's own credentials, rather than the identity bound to the resumed allocation. The only element bound to a specific victim is the victim's 56-bit mobile ID. After the takeover, the attacker's socket receives and injects traffic into the victim's media path, consuming the victim's quota and denying service to the victim. Scope of Impact CVSS v3 base metrics: - Attack vector: Network - Attack complexity: High - Privileges required: Low - User interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: Low CVE ID: CVE-2020-6581 CWE ID: CWE-639 Remediation Affected Versions: <= 4.14.0 (current 'master') Fixed Version: 4.15.0 POC Code Attack Steps 1. Capture the victim's MOBILITY-TICKET: Capture the victim's MOBILITY-TICKET (their 56-bit mobile ID string) from a successful STUN ALLOCATE / REFRESH response on a non-TLS listener. 2. Authenticate an attacker session: Authenticate an attacker session under the victim's valid credentials, then set the session's state to without valid credentials—for example, by sending an ALLOCATE (via MOBILITY-TICKET, plus the attacker's own USERNAME, the victim's REALM string, the attacker session's NONCE, and a VALID MESSAGE-INTEGRITY calculated using the attacker's own key). Alternatively, let an established allocation expire via . The TCP/TLS control connection remains open, acting like a persistent connection. 3. Send a REFRESH: Send a REFRESH within the same attacker session, containing the victim's MOBILITY-TICKET, plus the attacker's own USERNAME, the victim's REALM string, the attacker session's NONCE, and a VALID MESSAGE-INTEGRITY calculated using the attacker's own key. 4. Observe: The step (step 2) is skipped, passes using the attacker's own credentials, and the server transfers the victim's allocation/relay endpoint to the attacker's socket (successful REFRESH response with a new MOBILITY-TICKET, now bound to the attacker). Expected Result The attacker's socket becomes the client-side of the victim's relay allocation: it receives relay traffic from peers allowed by the victim, sends it through the victim's relay transport address, and consumes the victim's quota. The victim's original session is marked as and loses its allocation. Impact Direct Impact: - Confidentiality: High—the attacker receives relay traffic from peers allowed by the victim (media/data interception). - Integrity: High—the attacker can inject into the victim's relay transport path and rebind the session to their own identity. - Availability: Low—the victim's original session is closed, their allocation is taken over, and relay service to the victim is denied. Scope/Prerequisites Non-default (MICE) feature is required: dominant WebRTC relay deployments have not enabled it. Cross-domain takeover appears possible because the REALM string is only string-matched against the victim's REALM copied to line 1816—there is no per-domain key re-binding request to the attacker's domain.

Goal Reached Thanks to every supporter — we hit 100%!

coturn MOBILITY-TICKET Authorization Bypass allowing TURN Allocation Takeover (CVE-2020-6581)

More from this source