PT-2021-20931 · Wowza · Wowza Streaming Engine

Massimiliano Brolli + 2 · Published 2021-10-05 · Updated 2021-11-06 · CVE-2021-35491

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Wowza Streaming Engine versions 4.8.11+5 through 4.8.13

Description: A Cross-Site Request Forgery (CSRF) issue allows a remote attacker to delete a user account via the "/enginemanager/server/user/delete.htm" API endpoint using the userName parameter. The application does not implement a CSRF token for the GET request.

Recommendations: For versions 4.8.11+5 through 4.8.13, update to Wowza Streaming Engine release 4.8.14 to resolve the issue. As a temporary workaround, consider restricting access to the "/enginemanager/server/user/delete.htm" API endpoint to minimize the risk of exploitation. Avoid using the userName parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-35491

Affected Products

Wowza Streaming Engine

References · 7

• 🔥 https://gruppotim.it/redteam · Exploit
• https://wowza.com/docs/wowza-streaming-engine-4-8-14-release-notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35491 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35491 · Vendor Advisory
• https://n4nj0.github.io/advisories/wowza-streaming-engine-i · Note
• https://t.me/cvenotify/22169 · Telegram Post
• https://t.me/cibsecurity/29995 · Telegram Post