PT-2021-4479 · Restund · Restund
Sebastian Kemper
·
Published
2021-06-11
·
Updated
2022-10-21
·
CVE-2021-21382
CVSS v3.1
9.6
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Restund (affected versions not specified)
Description
The issue is related to the Restund TURN server, which can be instructed to open a relay to the loopback address range, potentially exposing private services running on localhost. An attacker can exploit this by setting the
XOR-PEER-ADDRESS to 127.0.0.1:{{restund udp status port}} when opening a TURN channel, allowing them to issue administrative commands to the status interface of Restund. This could enable the execution of arbitrary commands. To mitigate this, it is recommended to explicitly disallow relaying to loopback addresses, 'any' addresses, link local addresses, and the broadcast address.Recommendations
As a temporary workaround, consider disabling the
status module in your Restund configuration.
Disable the turn module if possible, as Restund will still perform STUN, which might be sufficient for initiating calls in your environment.
Ensure the TURN server is set up with firewall rules to prevent relaying to unwanted addresses.
Ideally, deploy TURN servers in an isolated fashion, allowing them to only reach necessary resources for their NAT-traversal task.Exploit
Fix
Missing Authorization
Exposure of Resource to Wrong Sphere
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Restund