Description
Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings_path via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending in -audio.mjr, -video.mjr or -data.mjr anywhere the Janus process can write outside protected folders.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
meetecho janus-gateway
Default version status: unaffected
0 to ≤ 1.4.3affected
pkg:github/meetecho/janus-gatewayReferences
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HkEaF-piGl ↗
- https://github.com/meetecho/janus-gateway/blob/1f0b75cac1c9ad819ee4c2a905a2c65b00b82cde/src/plugins/janus_recordplay.c#L1965 ↗
- https://github.com/meetecho/janus-gateway/blob/1f0b75cac1c9ad819ee4c2a905a2c65b00b82cde/src/record.c#L218 ↗
- https://github.com/meetecho/janus-gateway ↗
- https://www.vulncheck.com/advisories/janus-webrtc-server-through-1.4.3-path-traversal-via-record-play-filename ↗