7.5

CVE-2022-29169

ReDoS on endpoint html5client/useragent in BigBlueButton

ReDoS on endpoint html5client/useragent

BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression, an attacker can cause denial of service for the bbb-html5 service. The useragent library performs checking of device by parsing the input of User-Agent header and lets it go through lookupUserAgent() (alias of useragent.lookup() ). This function handles input by regexing and attackers can abuse that by providing some ReDos payload using `SmartWatch`. The maintainers removed `htmlclient/useragent` from versions 2.3.19, 2.4.7, and 2.5.0-beta.2. As a workaround, disable NginX forwarding the requests to the handler according to the directions in the GitHub Security Advisory.
Mögliche Gegenmaßnahme
Server: If you are not able to upgrade to a patched version, you can eliminate the attack surface by disabling NginX forwarding the requests to the handler. Add the following block to your NginX configuration. ``` location /html5client/useragent { return 404; } ``` For BigBlueButton 2.3 or 2.4 a good place to add this block would be in `/etc/bigbluebutton/nginx/` For BigBlueButton 2.5 a good place to add this block would be in `/usr/share/bigbluebutton/nginx/` Reload via `sudo systemctl reload nginx` Test this change by navigating to `<yourserver.com>/html5client/useragent` -- if you see 404, the workaround is active.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
BigBlueButton ≫ BigBlueButton Version >= 2.2.0 < 2.3.19
BigBlueButton ≫ BigBlueButton Version >= 2.4.0 < 2.4.7
BigBlueButton ≫ BigBlueButton Version 2.5 Update alpha1
BigBlueButton ≫ BigBlueButton Version 2.5 Update alpha2
BigBlueButton ≫ BigBlueButton Version 2.5 Update alpha3
BigBlueButton ≫ BigBlueButton Version 2.5 Update alpha4
BigBlueButton ≫ BigBlueButton Version 2.5 Update alpha5
BigBlueButton ≫ BigBlueButton Version 2.5 Update alpha6
BigBlueButton ≫ BigBlueButton Version 2.5 Update beta1
Weitere Schwachstelleninformationen
SystemBigBlueButton
≫
Produkt Server
Version >= 0.0.0, < 2.3.19
Version >= 2.4.0, < 2.4.7
Version >= 2.5.0, < 2.5.0-beta.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.52% 0.725
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
security-advisories@github.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1333 Inefficient Regular Expression Complexity

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://github.com/bigbluebutton/bigbluebutton/pull/14886
Patch
Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/pull/14896
Patch
Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rwrv-p665-4vwp
Patch
Third Party Advisory
Mitigation
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rwrv-p665-4vwp
Third Party Advisory