CVE-2025-66378

Executive Summary

CVE-2025-66378 is a medium-severity vulnerability affecting Pexip Infinity versions 38.0 and 38.1 prior to 39.0. The flaw resides in the RTMP (Real-Time Messaging Protocol) implementation, where insufficient access control allows an unauthenticated attacker to disconnect active RTMP streams traversing a Proxy Node. This can lead to denial of service (DoS) for video conferencing sessions relying on RTMP ingestion or egress. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, given the critical nature of video conferencing infrastructure, immediate patching is recommended.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Base Score: 5.9 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – no data exposure.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: Low (A:L) – can disconnect RTMP streams, causing service degradation.

Threat Level: Medium. The vulnerability is easy to exploit remotely but only affects availability, not data confidentiality or integrity. The lack of public exploits and low EPSS score reduce immediate risk, but the potential for disruption in video conferencing services warrants prompt attention.

Deep Dive & Mechanics

Pexip Infinity is a video conferencing platform that supports RTMP for streaming to and from external services (e.g., YouTube Live, Facebook Live). The RTMP implementation in versions 38.0 and 38.1 lacks proper access control checks when handling stream management commands. Specifically, the system does not validate that a request to disconnect an RTMP stream originates from an authorized source (e.g., the stream owner or an administrator). This allows an attacker who can reach the Proxy Node’s RTMP interface to send crafted packets that terminate active streams.

The vulnerability likely resides in the RTMP control channel, where commands like FCUnpublish or deleteStream are processed without verifying the caller’s identity. By sending a malicious RTMP handshake or control message, an attacker can force the server to close a stream, causing disruption to ongoing broadcasts or recordings.

Vulnerable vs. Patched Code

Since no patch details or code snippets are publicly available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (Pseudo-code):

def handle_rtmp_command(stream_id, command):
    # No access control check
    if command == "disconnect":
        stream_manager.disconnect(stream_id)
        return "OK"

Patched Code (Pseudo-code):

def handle_rtmp_command(stream_id, command, auth_token):
    # Access control check
    if not validate_auth_token(stream_id, auth_token):
        return "Unauthorized"
    if command == "disconnect":
        stream_manager.disconnect(stream_id)
        return "OK"

The patch introduces authentication token validation for stream management commands, ensuring only authorized users can disconnect streams.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Pexip Infinity Proxy Node (version 38.0 or 38.1) with RTMP enabled.
• Network connectivity to the RTMP port (default 1935).

Exploitation Steps:

1. Identify an active RTMP stream by monitoring network traffic or using a tool like rtmpdump.
2. Craft a malicious RTMP control message to disconnect the stream. Example using Python with scapy:

   from scapy.all import *
   import struct
   
   # Build RTMP disconnect command
   payload = b"\x03" + struct.pack(">I", 0)  # Chunk basic header + timestamp
   payload += b"\x14\x00\x00\x00"  # Message type ID (20 = AMF0 command)
   payload += b"\x00\x00\x00\x00"  # Message stream ID
   # AMF0 encoded command: "disconnectStream"
   amf_command = b"\x02\x00\x0fdisconnectStream\x00\x00\x00\x00"
   payload += amf_command
   
   send(IP(dst="TARGET_IP")/TCP(dport=1935)/Raw(load=payload))
   

3. The stream is terminated, causing a denial of service.

Note: This is a conceptual example. Actual exploitation may require deeper understanding of RTMP protocol specifics.

Blue Team

Detection & Response:

• Monitor RTMP traffic for unusual control commands, especially FCUnpublish or deleteStream from unexpected sources.
• Enable logging on Pexip Infinity to capture RTMP stream events.
• Use network segmentation to restrict access to RTMP ports to trusted IPs only.
• Implement rate limiting on RTMP control commands to mitigate brute-force attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unexpected RTMP control packets (e.g., FCUnpublish, deleteStream) from unknown IPs.
  • Repeated connection attempts to port 1935/TCP from a single source.
• Log IOCs:
  • Log entries showing stream disconnections without corresponding authorized actions.
  • Errors in RTMP stream management logs indicating unauthorized access attempts.
• System IOCs:
  • Unexplained termination of RTMP streams during active conferences.

Detection Engineering

YARA Rule

rule CVE_2025_66378_RTMP_Disconnect {
    meta:
        description = "Detects RTMP disconnect commands targeting Pexip Infinity"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66378"
    strings:
        $disconnect = "disconnectStream" ascii wide nocase
        $fcunpublish = "FCUnpublish" ascii wide nocase
        $deletestream = "deleteStream" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-66378 - RTMP Stream Disconnect Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to disconnect RTMP streams on Pexip Infinity
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66378
logsource:
    category: network
    product: pexip
    service: rtmp
detection:
    selection:
        event: "stream_disconnect"
        source_ip|re: "^(?!10\.|172\.(1[6-9]|2[0-9]|3[01])|192\.168\.)"
    condition: selection
falsepositives:
    - Legitimate stream management by authorized users
level: medium

Suricata Rule

alert tcp any any -> any 1935 (msg:"CVE-2025-66378 - RTMP Stream Disconnect Attempt"; flow:to_server; content:"|02 00 0f|disconnectStream"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Pexip Infinity to version 39.0 or later.
2. If immediate upgrade is not possible, restrict network access to the RTMP port (1935/TCP) to trusted IPs only using firewall rules.
3. Monitor RTMP traffic for anomalous disconnect commands.

Long-term Measures:

• Implement network segmentation to isolate Proxy Nodes.
• Enable logging and alerting for RTMP stream management events.
• Conduct regular vulnerability scans and patch management.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.