BigBlueButton v3.0.23 Security Advisory: SQL Injection, Race Condition, and Sensitive Info Disclosure Fixes

Vulnerability Overview Multiple security vulnerabilities were identified in BigBlueButton v3.0.23, primarily affecting the following areas: 1. Race Condition: - A race condition may occur when a user joins a breakout room. - Fix: Prevent race conditions to ensure users join breakout rooms correctly. 2. Re-assigning Users: - Users were being re-assigned to their last breakout room. - Fix: Stop re-assigning users to their last breakout room. 3. User Activity for Breakout Rooms: - User activity was only recorded for the main meeting, not for breakout rooms. - Fix: Record user activity for breakout rooms. 4. Password/Auth Token Logging: - Passwords/auth tokens were being logged. - Fix: Stop logging passwords/auth tokens. 5. API Controller Helper Methods: - Certain API controller helper methods were exposed. - Fix: Set these methods to private and include security fixes. 6. Max Custom Poll Settings: - Enforce maximum custom poll settings. - Fix: Enforce maximum custom poll settings and include security fixes. 7. Additional Checks in Polls: - Add additional checks in polls. - Fix: Add additional checks in polls and include security fixes. 8. SQL Injection: - Use bound parameters in SQL queries. - Fix: Use bound parameters in SQL queries and include security fixes. 9. Presentation Download URL Validation: - Fix validation of presentation download URLs. - Fix: Fix validation of presentation download URLs and include security fixes. 10. Chat Min-Max Character Settings: - Enforce chat min/max character settings. - Fix: Enforce chat min/max character settings and include security fixes. Impact Scope These vulnerabilities may affect all users running BigBlueButton v3.0.23, particularly those utilizing breakout rooms, polls, API controllers, SQL queries, and chat features. Remediation 1. Race Condition: - Fix: Prevent race conditions to ensure users join breakout rooms correctly. 2. Re-assigning Users: - Fix: Stop re-assigning users to their last breakout room. 3. User Activity Logging: - Fix: Record user activity for breakout rooms. 4. Password/Auth Token Logging: - Fix: Stop logging passwords/auth tokens. 5. API Controller Helper Methods: - Fix: Set these methods to private and include security fixes. 6. Max Custom Poll Settings: - Fix: Enforce maximum custom poll settings and include security fixes. 7. Additional Checks in Polls: - Fix: Add additional checks in polls and include security fixes. 8. SQL Injection: - Fix: Use bound parameters in SQL queries and include security fixes. 9. Presentation Download URL Validation: - Fix: Fix validation of presentation download URLs and include security fixes. 10. Chat Min-Max Character Settings: - Fix: Enforce chat min/max character settings and include security fixes. Code Blocks No specific POC code or exploit code is included in this report. Summary Multiple security vulnerabilities exist in BigBlueButton v3.0.23, involving race conditions, user re-assignment, user activity logging, password/auth token logging, exposed API controller helper methods, max custom poll settings, additional checks in polls, SQL injection, presentation download URL validation, and chat min/max character settings. These vulnerabilities may impact all users of this version, especially those utilizing the affected features. Remediation measures include preventing race conditions, stopping the logging of sensitive information, and using bound parameters. Administrators are advised to update to the latest version as soon as possible to ensure security.

Goal Reached Thanks to every supporter — we hit 100%!

BigBlueButton v3.0.23 Security Advisory: SQL Injection, Race Condition, and Sensitive Info Disclosure Fixes

More from this source