CVE-2025-66377

Executive Summary

CVE-2025-66377 is a critical vulnerability in Pexip Infinity, a video conferencing and collaboration platform. The flaw resides in a product-internal API that lacks authentication for a critical function. An attacker who has already achieved code execution on one node within a Pexip Infinity installation can leverage this missing authentication to impact the operation of other nodes in the cluster. This effectively allows lateral movement and potential disruption of the entire conferencing infrastructure. The vulnerability has a CVSS score of 7.5 (High), and while no public exploit code or proof-of-concept is currently available, the risk is significant due to the potential for cascading failures across a multi-node deployment. The vendor has released a fix in version 39.0.

Supply Chain & Package Security

This vulnerability is not related to a software supply chain package (NPM, PyPI, Go, Ruby). It is a direct product vulnerability in Pexip Infinity's proprietary code.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - The attacker does not need prior authentication to the vulnerable API, but they must already have code execution on one node.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The impact is confined to the affected component.
• Confidentiality (C): None (N) - No direct data breach.
• Integrity (I): High (H) - The attacker can modify the operation of other nodes.
• Availability (A): High (H) - The attacker can disrupt or disable other nodes.

Threat Level: High. While the initial foothold (code execution on one node) is a prerequisite, the ability to pivot and impact other nodes without further authentication makes this a serious threat for lateral movement and denial of service within a Pexip Infinity cluster.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authentication for Critical Function (CWE-306). Pexip Infinity uses a set of internal APIs for inter-node communication and management. One or more of these APIs, which control critical functions like node state, configuration, or service restart, do not require authentication when called from within the cluster network.

Attack Flow:

1. Initial Compromise: The attacker first gains code execution on a single Pexip Infinity node. This could be achieved through another vulnerability, weak credentials, or a compromised administrative interface.
2. Lateral Movement: Once inside the node, the attacker discovers the unauthenticated internal API endpoint. They can then craft HTTP requests (likely using tools like curl or a custom script) to this API.
3. Impact on Other Nodes: The attacker sends malicious requests to the API, targeting other nodes in the cluster. This could involve:
   • Denial of Service (DoS): Sending commands to restart or shut down other nodes.
   • Configuration Tampering: Altering the configuration of other nodes to disrupt service or create backdoors.
   • Data Manipulation: Potentially modifying call routing or media processing settings.

The vulnerability is internal to the Pexip Infinity product and does not rely on any external libraries or open-source components.

Vulnerable vs. Patched Code

Since the exact vulnerable code is proprietary, a direct code comparison is not possible. However, the conceptual difference is clear:

Vulnerable Code (Pre-39.0):

# Hypothetical vulnerable API endpoint
@app.route('/api/internal/node/control', methods=['POST'])
def control_node():
    # No authentication check
    action = request.json.get('action')
    target_node = request.json.get('node_id')
    # Execute action on target_node (e.g., restart, shutdown)
    execute_action(target_node, action)
    return jsonify({"status": "success"})

Patched Code (39.0+):

# Hypothetical patched API endpoint
@app.route('/api/internal/node/control', methods=['POST'])
@require_internal_auth  # New authentication decorator
def control_node():
    # Authentication check passed
    action = request.json.get('action')
    target_node = request.json.get('node_id')
    # Execute action on target_node
    execute_action(target_node, action)
    return jsonify({"status": "success"})

The patch introduces an authentication mechanism (e.g., a shared secret, certificate, or token) that must be validated before the API will process the request.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A lab environment with at least two Pexip Infinity nodes (version < 39.0).
• Code execution on one node (e.g., via SSH with compromised credentials or a web shell).

Exploitation Steps:

1. Reconnaissance: From the compromised node, scan for other nodes in the cluster. This can be done by checking the /etc/hosts file or using nmap to scan the internal network.

   nmap -sn 192.168.1.0/24
   

2. Identify API Endpoint: Use netstat or ss to find listening ports. The internal API likely runs on a high port (e.g., 8443 or 9443). Use curl to probe for the vulnerable endpoint.

   curl -k https://<target_node_ip>:9443/api/internal/node/control
   

3. Craft Exploit: Send a POST request to trigger a denial of service on another node.

   curl -k -X POST https://<target_node_ip>:9443/api/internal/node/control \
     -H "Content-Type: application/json" \
     -d '{"action": "restart", "node_id": "node2"}'
   

4. Verify Impact: The target node should become unresponsive or restart, confirming the exploit.

Blue Team (Defensive)

Detection & Response:

1. Monitor Internal API Calls: Enable logging on all nodes for the internal API. Look for POST requests to /api/internal/node/control or similar endpoints from unexpected source IPs.
2. Network Segmentation: Ensure that the internal API network is isolated from the management and user-facing networks. Use firewalls to restrict access to the API port only from trusted node IPs.
3. Harden Initial Access: Implement strong authentication (e.g., SSH keys, multi-factor authentication) for all administrative access to nodes. Regularly audit user accounts and permissions.
4. Deploy Honeypots: Create a decoy node that mimics a real Pexip Infinity node. Monitor for any attempts to access the internal API from unauthorized sources.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual POST requests to internal API endpoints (e.g., /api/internal/node/control) from a node that is not the management node.
  • Traffic on high ports (e.g., 8443, 9443) between nodes that is not part of normal cluster heartbeat or replication.
• Host IOCs:
  • Unexpected processes or scripts running on a node that are making outbound HTTP requests.
  • Modified configuration files on a node (e.g., /etc/pexip/config.json).
  • Log entries showing node restarts or shutdowns that were not initiated by an administrator.
• Log IOCs:
  • In the Pexip Infinity logs, entries like "action": "restart" or "action": "shutdown" without a corresponding authenticated user session.

Detection Engineering

YARA Rule

rule CVE_2025_66377_Pexip_Internal_API_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-66377 by looking for POST requests to the vulnerable internal API endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66377"
    strings:
        $api_endpoint = "/api/internal/node/control"
        $json_action = "action"
        $json_node_id = "node_id"
    condition:
        $api_endpoint and $json_action and $json_node_id
}

Sigma Rule

title: Pexip Infinity Internal API Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to the vulnerable Pexip Infinity internal API endpoint
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66377
logsource:
    category: webserver
    product: pexip_infinity
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/internal/node/control'
    condition: selection
falsepositives:
    - Legitimate administrative actions from the management node
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66377 Pexip Infinity Internal API Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/api/internal/node/control"; http_uri; content:"action"; http_client_body; content:"node_id"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade all Pexip Infinity nodes to version 39.0 or later. This is the only definitive fix.
2. Network Isolation: If patching is not immediately possible, implement strict firewall rules to allow the internal API port (e.g., 9443) only between known, trusted node IPs. Block all other traffic to this port.
3. Monitor: Enable detailed logging on all nodes and monitor for any suspicious API calls.

Long-Term Mitigations:

1. Principle of Least Privilege: Ensure that any user or process that gains access to a node has the minimum necessary permissions.
2. Regular Security Audits: Conduct periodic security assessments of the Pexip Infinity deployment, including penetration testing of internal APIs.
3. Vulnerability Management: Subscribe to Pexip's security advisories and apply patches promptly.

Valters IT