CVE-2024-37917

Executive Summary

CVE-2024-37917 is a denial-of-service (DoS) vulnerability in Pexip Infinity, a video conferencing and collaboration platform. The flaw resides in improper input validation of signalling messages, allowing a remote, unauthenticated attacker to trigger a software abort, effectively crashing the affected service. This can lead to service disruption for all users relying on the platform. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, the impact is high for organizations using Pexip Infinity for critical communications.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise software product (Pexip Infinity). Supply chain risks are limited to the vendor's software distribution and update mechanisms.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The attack is launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete service disruption.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Threat Level: High. The vulnerability is remotely exploitable without authentication and can cause a complete denial of service.

Deep Dive & Mechanics

The vulnerability is rooted in improper input validation within Pexip Infinity's signalling message handling. Signalling messages are used to establish, maintain, and terminate media sessions (e.g., SIP, H.323, or proprietary protocols). When a specially crafted signalling message is received, the software fails to validate the input correctly, leading to a memory corruption or an unhandled exception that causes the software to abort.

Technical Breakdown:

1. Attack Vector: The attacker sends a malformed signalling message to a listening port on the Pexip Infinity server.
2. Input Validation Failure: The server's parsing logic does not properly check the structure, length, or content of the message fields.
3. Software Abort: The invalid input triggers a fatal error (e.g., null pointer dereference, buffer overflow, or assertion failure), causing the process to crash.
4. Denial of Service: The crash disrupts all active conferences and prevents new connections until the service is manually restarted or automatically recovered.

Vulnerable vs. Patched Code

No specific code snippets are available from public sources. However, the fix in version 35.0 likely involves:

• Vulnerable Code (Conceptual):

  // Example of improper input validation
  void process_signalling_message(char *msg) {
      int length = atoi(get_field(msg, "length"));
      char *data = malloc(length);
      // No check if length is valid or if data is null
      memcpy(data, get_field(msg, "data"), length);
      // ... further processing
  }
  

• Patched Code (Conceptual):

  // Example of proper input validation
  void process_signalling_message(char *msg) {
      int length = atoi(get_field(msg, "length"));
      if (length <= 0 || length > MAX_MSG_SIZE) {
          log_error("Invalid message length");
          return;
      }
      char *data = malloc(length);
      if (data == NULL) {
          log_error("Memory allocation failed");
          return;
      }
      memcpy(data, get_field(msg, "data"), length);
      // ... further processing
  }
  

Exploitation & Lab Setup

No public exploit code is available. The following is a conceptual lab setup for testing.

Red Team (Simulated Attack)

1. Setup: Deploy a vulnerable Pexip Infinity instance (version < 35.0) in an isolated lab environment.
2. Craft Payload: Use a scripting language (e.g., Python) to create a malformed signalling message. The exact structure depends on the protocol used (e.g., SIP INVITE with an oversized header).

   import socket
   
   # Example: Malformed SIP message
   payload = b"INVITE sip:user@target.com SIP/2.0\r\n"
   payload += b"Via: SIP/2.0/UDP 192.168.1.1:5060\r\n"
   payload += b"Content-Length: 999999999\r\n"  # Invalid length
   payload += b"\r\n"
   payload += b"A" * 1000  # Oversized body
   
   sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
   sock.sendto(payload, ("<TARGET_IP>", 5060))
   sock.close()
   

3. Execute: Send the crafted message to the target server.
4. Observe: Monitor the server for crashes (e.g., service stop, core dump).

Blue Team (Detection & Response)

1. Monitor Logs: Enable detailed logging for signalling protocols. Look for entries like:
   • ERROR: Invalid message length
   • CRITICAL: Unhandled exception in signalling handler
   • SERVICE STOPPED: Pexip Infinity
2. Network Monitoring: Capture and inspect signalling traffic for anomalies (e.g., unusually large packets, malformed headers).
3. Honeypot: Deploy a decoy Pexip instance to attract and analyze attack attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusually large or malformed SIP/H.323 packets.
  • Packets with invalid Content-Length or other header fields.
  • Repeated connection attempts from a single IP to signalling ports (e.g., UDP 5060 for SIP).
• System IOCs:
  • Core dump files in the Pexip installation directory.
  • Service logs containing SIGABRT or SIGSEGV signals.
  • Unexpected restart of the Pexip Infinity service.
• File IOCs:
  • Temporary files with malformed data in /tmp/ or similar directories.

Detection Engineering

YARA Rule

rule CVE_2024_37917_Pexip_DoS {
    meta:
        description = "Detects malformed signalling messages targeting Pexip Infinity"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-37917"
    strings:
        $sip_invite = "INVITE sip:" ascii
        $invalid_length = "Content-Length: 999999999" ascii
        $overflow_data = /[A-Za-z0-9]{1000,}/ ascii
    condition:
        $sip_invite and ($invalid_length or $overflow_data)
}

Sigma Rule

title: CVE-2024-37917 - Pexip Infinity DoS via Malformed Signalling
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation attempts of CVE-2024-37917 by monitoring for malformed SIP messages.
author: Valters IT
date: 2024/10/27
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        event_type: alert
        alert.signature_id: 3000001  # Custom ID for this rule
    condition: selection
falsepositives:
    - Legitimate but malformed traffic from faulty clients
level: high

Suricata Rule

alert udp any any -> $HOME_NET 5060 (msg:"CVE-2024-37917 - Pexip Infinity Malformed SIP Message"; content:"INVITE"; content:"Content-Length"; distance:0; within:100; content:"|0d 0a|"; within:50; byte_test:1,>,200,0,relative; sid:3000001; rev:1;)

Remediation & Mitigation

1. Immediate Action:
   • Upgrade to Pexip Infinity version 35.0 or later.
   • If immediate patching is not possible, restrict network access to signalling ports (e.g., UDP 5060) to trusted IP addresses only.
2. Long-term Measures:
   • Implement a Web Application Firewall (WAF) or Intrusion Prevention System (IPS) with custom rules to filter malformed signalling messages.
   • Enable and monitor detailed logging for all signalling protocols.
   • Conduct regular security audits and penetration testing on the Pexip infrastructure.
3. Workarounds:
   • If patching is delayed, consider disabling the affected signalling protocol (if not required) or using a session border controller (SBC) to sanitize traffic.

Valters IT