published September 25, 2020
⚠️ A little oversight in UDP access control could leave your TURN server open! With Pexip versions before 6.1.0, the wrong packets might just slip through the cracks. 🔒 Think of it like a restaurant that forgets to check who enters the kitchen — anyone could waltz in and grab the chef's secret recipes! In the same way, incorrect access controls on the TURN server can allow unauthorized users access to sensitive information. This vulnerability could potentially allow an attacker to intercept or manipulate UDP traffic, leading to unauthorized access to media streams. While not known to be actively exploited, the risk remains if the server is left unpatched, making it a sneaky threat.
Think of it like a restaurant that forgets to check who enters the kitchen — anyone could waltz in and grab the chef's secret recipes! In the same way, incorrect access controls on the TURN server can allow unauthorized users access to sensitive information. The Pexip Reverse Proxy and TURN Server prior to version 6.1.0 have incorrect access control measures for UDP packets via TURN, which could be exploited to gain unauthorized access.
This vulnerability could potentially allow an attacker to intercept or manipulate UDP traffic, leading to unauthorized access to media streams. While not known to be actively exploited, the risk remains if the server is left unpatched, making it a sneaky threat. Upgrade to Pexip version 6.1.0 or later immediately to close this loophole. Additionally, review your server configurations to ensure that access controls are correctly enforced for UDP traffic. You've got this! Lock down your TURN server and keep your media traffic safe! 🛡️