CVE-2025-61601

Executive Summary

CVE-2025-61601 is a high-severity Denial of Service (DoS) vulnerability in BigBlueButton, an open-source virtual classroom platform. The flaw resides in the polling feature's Choices response type. An authenticated attacker can submit a malicious payload with an excessively large array in the answerIds field, causing the server to become unresponsive. This can freeze or crash the current meeting and potentially all meetings on the same server. The vulnerability is unpatched in versions prior to 3.0.13, and no workarounds are available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for unpatched deployments.

Supply Chain & Package Security

BigBlueButton is distributed as a Debian/Ubuntu package. The vulnerability is in the core application code, not in a third-party dependency. Administrators should verify the integrity of the package using GPG signatures and checksums provided by the official BigBlueButton repository.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The vulnerability allows an authenticated user to cause a complete denial of service, affecting the availability of the entire server.

Deep Dive & Mechanics

The vulnerability is in the polling feature's Choices response type. When a user submits a poll response, the server processes the answerIds field. By sending a JSON payload with an extremely large array of integers in answerIds, the server attempts to allocate memory and process the array, leading to resource exhaustion. This can cause the meeting process to hang or crash, and due to shared server resources, can impact all meetings on the same BigBlueButton instance.

The root cause is a lack of input validation on the size of the answerIds array. The server does not enforce a maximum limit, allowing an attacker to send an array with thousands or millions of entries.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 3.0.13):

// In PollService.java or similar
public void handlePollResponse(String meetingId, String userId, List<Integer> answerIds) {
    // No validation on answerIds size
    for (Integer answerId : answerIds) {
        // Process each answer
    }
}

Patched Code (3.0.13):

// In PollService.java or similar
public void handlePollResponse(String meetingId, String userId, List<Integer> answerIds) {
    if (answerIds.size() > MAX_ANSWERS) {
        throw new IllegalArgumentException("Too many answers");
    }
    for (Integer answerId : answerIds) {
        // Process each answer
    }
}

The patch adds a check to limit the size of the answerIds array to a predefined maximum (e.g., 100).

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a BigBlueButton instance (version < 3.0.13)
• Valid user credentials (e.g., moderator or attendee)

Exploit Steps:

1. Join a meeting as an authenticated user.
2. Wait for a poll to be created (or create one if you have moderator privileges).
3. Send a malicious poll response with a large answerIds array.

Example Payload (using curl):

curl -X POST https://target-server/bigbluebutton/api/pollResponse \
  -H "Content-Type: application/json" \
  -d '{
    "meetingId": "meeting-123",
    "userId": "user-456",
    "pollId": "poll-789",
    "answerIds": [1, 2, 3, ... , 1000000]
  }'

Expected Outcome: The server becomes unresponsive, freezing or crashing the meeting and potentially all meetings on the server.

Blue Team

Detection:

• Monitor for unusually large poll response payloads.
• Look for repeated requests with large answerIds arrays.
• Use network monitoring to detect anomalous traffic patterns.

Mitigation:

• Immediately upgrade to BigBlueButton 3.0.13 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests with excessively large JSON arrays.
• Restrict API access to trusted users only.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /bigbluebutton/api/pollResponse with JSON payloads containing answerIds arrays of size > 1000.
• Logs: Server logs showing OutOfMemoryError or java.lang.OutOfMemoryError in the BigBlueButton application logs.
• System: High CPU or memory usage on the BigBlueButton server, leading to unresponsive meetings.

Detection Engineering

YARA Rule

rule CVE_2025_61601_BigBlueButton_DoS {
    meta:
        description = "Detects malicious poll response payloads for CVE-2025-61601"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-61601"
    strings:
        $json_start = /"answerIds"\s*:\s*\[/
        $large_array = /\[[0-9,\s]{1000,}\]/
    condition:
        $json_start and $large_array
}

Sigma Rule

title: BigBlueButton DoS via Poll Response
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-61601 by sending large answerIds arrays
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/bigbluebutton/api/pollResponse'
        cs-uri-query|contains: 'answerIds'
        sc-bytes: '>10000'
    condition: selection
falsepositives:
    - Legitimate large polls (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-61601 BigBlueButton DoS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/bigbluebutton/api/pollResponse"; http_uri;
    content:"answerIds"; http_client_body;
    pcre:"/\[[0-9,\s]{1000,}\]/";
    sid:1000001;
    rev:1;
    reference:cve,2025-61601;
    classtype:attempted-dos;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to BigBlueButton version 3.0.13 or later.
2. If upgrade is not possible, implement a WAF rule to block requests with answerIds arrays larger than 100 elements.
3. Monitor server logs for signs of exploitation.

Long-term Measures:

• Implement input validation on all API endpoints.
• Regularly update BigBlueButton to the latest version.
• Conduct security audits of custom integrations.

Workarounds: None available.

Valters IT