PT-2023-24192 · Unknown · Bigbluebutton

Abdulmohsen Alotaibi · Published 2023-06-26 · Updated 2023-10-31 · CVE-2023-33176

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions BigBlueButton (affected versions not specified)

Description BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions, a Server-Side Request Forgery (SSRF) vulnerability exists. The insertDocument API request allows users to supply a URL from which the presentation should be downloaded, and this URL was being used without validation. An update to the followRedirect method in the PresentationUrlDownloadService has been made to validate all URLs for presentation download. Two new properties, presentationDownloadSupportedProtocols and presentationDownloadBlockedHosts, have been added to bigbluebutton.properties to define allowed protocols and blocked hosts for presentation downloads. URLs passed to insertDocument must conform to these requirements, resolve to valid addresses, and not be local or loopback addresses.

Recommendations To resolve the issue, users are advised to upgrade to a patched version of BigBlueButton. As a temporary workaround, consider restricting access to the insertDocument API endpoint until a patch is available. Additionally, administrators can define allowed protocols and blocked hosts using the presentationDownloadSupportedProtocols and presentationDownloadBlockedHosts properties in bigbluebutton.properties to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-33176

GHSA-3Q22-HPH2-CFF7

Affected Products

Bigbluebutton

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33176.json · Exploit
• https://github.com/bigbluebutton/bigbluebutton/pull/18045 · Patch
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3q22-hph2-cff7 · Vendor Advisory
• https://github.com/bigbluebutton/bigbluebutton/commit/b18aff32e65a47f1eb2c800e86dcfc7a8fb05e71 · Patch
• https://github.com/bigbluebutton/bigbluebutton/commit/43394dade595d0707384e4878357901537352415 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-33176 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33176 · Vendor Advisory
• https://github.com/bigbluebutton/bigbluebutton/pull/18052 · Note
• https://t.me/cibsecurity/65533 · Telegram Post
• https://t.me/cibsecurity/73198 · Telegram Post
• https://t.me/cvenotify/53063 · Telegram Post