PT-2024-24748 · Unknown · Ant Media Server

Unc1739

·

Published

2024-04-22

·

Updated

2024-05-12

·

CVE-2024-32656

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ant Media Server versions 2.6.0 through 2.8.2
Description A local privilege escalation issue is present in Ant Media Server, allowing any unprivileged operating system user account to escalate privileges to the root user account on the system. This issue arises from Ant Media Server running with Java Management Extensions (JMX) enabled and authentication disabled on localhost on port 5599/TCP. An unprivileged operating system user can connect to the JMX service running on port 5599/TCP on localhost and leverage the MLet Bean within JMX to load a remote MBean from an attacker-controlled server, allowing an attacker to execute arbitrary code within the Java process run by Ant Media Server and execute code within the context of the antmedia service account on the system.
Recommendations For versions 2.6.0 through 2.8.2, update to version 2.9.0 to resolve the issue. As a temporary workaround, remove the following parameters from the antmedia.service file: -Dcom.sun.management.jmxremote, -Dcom.sun.management.jmxremote.authenticate=false, -Dcom.sun.management.jmxremote.ssl=false, -Dcom.sun.management.jmxremote.port=5599, -Dcom.sun.management.jmxremote.local.only=true, -Dcom.sun.management.jmxremote.host=127.0.0.1, -Djava.rmi.server.hostname=127.0.0.1, -Djava.rmi.server.useLocalHostname=true, and -Dcom.sun.management.jmxremote.rmi.port=5599.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-32656
GHSA-QWHW-HH9J-54F5

Affected Products

Ant Media Server