Vulnerability in Coturn
CVE-2020-26262
Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.015 (73.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 73.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.015 · change: +0.002
Affected products
- Coturn — versions < 4.5.2
- Coturn Project
- Fedoraproject Fedora — versions 32, 33
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p (Exploit, Third Party Advisory)
- github.com/coturn/coturn/commit/abfe1fd08d78baa0947d17dac0f7411c3d948e4d (Patch, Third Party Advisory)
- github.com/coturn/coturn/blob/57180ab60afcaeb13537e69ae8cb8aefd8f3f546/ChangeLog (Third Party Advisory, Release Notes)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
Frequently asked questions
- What is CVE-2020-26262?
- CVE-2020-26262 is a high-severity vulnerability in Coturn, classified under Unintended Proxy or Intermediary (Confused Deputy). CVSS score: 7.2/10. Published 2021-01-13.
- How severe is CVE-2020-26262?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2020-26262 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.