CVE-2024-33530

Executive Summary

CVE-2024-33530 is a logic flaw in Jitsi Meet, an open-source video conferencing application, affecting versions prior to 9391. The vulnerability allows an attacker to disclose the meeting password when a user is invited to a call after waiting in the lobby. This occurs due to improper handling of password-protected meetings that use a lobby feature. The flaw enables unauthorized access to sensitive meeting credentials, potentially leading to unauthorized meeting participation and data exposure.

Supply Chain & Package Security

Jitsi Meet is distributed as a Node.js application via npm and Docker images. The vulnerability affects the core application logic, not a specific package dependency. However, organizations using Jitsi Meet should verify their deployment version and ensure they are running version 9391 or later. The npm package jitsi-meet should be updated to the latest patched version.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unavailable) Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required (attacker must be in lobby) Scope: Unchanged Confidentiality Impact: High (password disclosure) Integrity Impact: None Availability Impact: None

Threat Level: High. The vulnerability allows an unauthenticated attacker to obtain meeting passwords, enabling unauthorized access to private meetings. The attack requires the attacker to be in the lobby and wait for an invitation, but this is a common scenario in Jitsi Meet usage.

Deep Dive & Mechanics

The vulnerability resides in the lobby handling logic of Jitsi Meet. When a meeting is password-protected and uses a lobby, the system incorrectly includes the meeting password in the invitation payload sent to users waiting in the lobby. This occurs because the password is not properly stripped from the invitation data before being sent to lobby participants.

Root Cause: The flaw is in the server-side logic that constructs the invitation message. When a user is admitted from the lobby to the meeting, the system sends an invitation that includes the meeting password in the URL or metadata. This password should be omitted for security reasons.

Attack Flow:

1. Attacker joins a password-protected Jitsi meeting that has a lobby enabled.
2. Attacker waits in the lobby.
3. A legitimate user or moderator invites the attacker to the meeting.
4. The invitation sent to the attacker includes the meeting password.
5. Attacker extracts the password and can now join the meeting directly without going through the lobby.

Technical Details: The vulnerability is in the lobby.js or similar component that handles lobby admission. The invitation payload contains the password field which is not sanitized before being sent to the lobby participant.

Vulnerable vs. Patched Code

Vulnerable Code (pre-9391):

// In lobby.js or similar
function admitUser(userId) {
  const meetingPassword = getMeetingPassword();
  const invitation = {
    userId: userId,
    password: meetingPassword, // Vulnerability: password included
    meetingId: getMeetingId()
  };
  sendInvitation(invitation);
}

Patched Code (9391+):

// In lobby.js or similar
function admitUser(userId) {
  const meetingPassword = getMeetingPassword();
  const invitation = {
    userId: userId,
    // password field removed
    meetingId: getMeetingId()
  };
  sendInvitation(invitation);
}

The fix removes the password field from the invitation payload, ensuring that lobby participants do not receive the meeting password when admitted.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Jitsi Meet instance running version < 9391
• A password-protected meeting with lobby enabled
• Ability to join the meeting as a lobby participant

Exploitation Steps:

1. Identify a target Jitsi Meet instance (e.g., https://meet.example.com).
2. Create a password-protected meeting with lobby enabled.
3. Join the meeting as a lobby participant (e.g., using a different browser or incognito window).
4. Wait for a moderator to admit you to the meeting.
5. Capture the network traffic during the admission process.
6. Extract the meeting password from the invitation payload.

Example using curl:

# Monitor WebSocket traffic for invitation payload
# The password will be visible in the JSON payload

Automated Exploit (Python):

import websocket
import json

def on_message(ws, message):
    data = json.loads(message)
    if 'password' in data:
        print(f"Password disclosed: {data['password']}")

ws = websocket.WebSocketApp("wss://meet.example.com/xmpp-websocket",
                            on_message=on_message)
ws.run_forever()

Blue Team

Detection:

• Monitor for unusual lobby admission patterns
• Check for multiple rapid admissions from the same IP
• Analyze WebSocket traffic for password fields in invitation payloads

Hunting:

• Search logs for password field in lobby admission events
• Look for anomalies in meeting join times (e.g., users joining immediately after lobby admission)

Mitigation:

• Upgrade to Jitsi Meet version 9391 or later
• Implement additional authentication mechanisms (e.g., OAuth)
• Monitor for unauthorized meeting access

Indicators of Compromise (IOCs)

Network IOCs:

• WebSocket messages containing "password" field in invitation payloads
• Unusual number of lobby admission requests from single IP
• Rapid succession of lobby admissions followed by direct joins

Log IOCs:

• Log entries showing password field in lobby admission events
• Multiple admitUser calls from same moderator in short time
• Users joining meetings without going through lobby after being admitted

File IOCs:

• Modified lobby.js or similar files (if attacker modified source)
• Suspicious configuration changes in Jitsi Meet settings

Detection Engineering

YARA Rule

rule CVE_2024_33530_Jitsi_Password_Disclosure {
    meta:
        description = "Detects Jitsi Meet password disclosure in network traffic"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-33530"
    strings:
        $password_field = /"password"\s*:\s*"[^"]+"/ nocase
        $lobby_admit = /admitUser|invitation|admit/ nocase
        $jitsi_header = /X-Jitsi-Conference/ nocase
    condition:
        $jitsi_header and $password_field and $lobby_admit
}

Sigma Rule

title: Jitsi Meet Password Disclosure via Lobby Admission
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects Jitsi Meet password disclosure in WebSocket traffic
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-33530
logsource:
    category: websocket
    product: jitsi
detection:
    selection:
        payload|contains: '"password"'
        payload|contains: 'admitUser'
    condition: selection
falsepositives:
    - Legitimate password transmission in other contexts
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-33530 Jitsi Meet Password Disclosure"; flow:to_server,established; content:"X-Jitsi-Conference"; nocase; content:"password"; nocase; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Jitsi Meet to version 9391 or later.
2. If upgrade is not possible, disable the lobby feature for password-protected meetings.
3. Rotate all meeting passwords that may have been exposed.

Long-term Mitigations:

1. Implement additional authentication mechanisms (e.g., OAuth, LDAP).
2. Enable end-to-end encryption for meetings.
3. Monitor for unauthorized access attempts.
4. Conduct regular security audits of Jitsi Meet configurations.

Workarounds:

• Use a separate authentication system (e.g., JWT tokens) instead of meeting passwords.
• Disable the lobby feature for sensitive meetings.
• Implement network-level controls to restrict access to Jitsi Meet instances.

Patch Verification:

• Check Jitsi Meet version: curl -s https://meet.example.com/version
• Verify lobby.js file hash matches patched version.

Valters IT
Securing Digital Frontiers