CVE-2022-29169 ReDoS on endpoint html5client/useragent in BigBlueButton
Attackers can cause denial of service in BigBlueButton by sending malicious User-Agent headers that trigger regular expression denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-29169?
CVE-2022-29169 is a high-severity denial of service vulnerability in bigbluebutton, published on 1 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression, an attacker can cause denial of service for the bbb-html5 service. The useragent library performs checking of device by parsing the input of User-Agent header and lets it go through lookupUserAgent() (alias of useragent.lookup() ). This function handles input by regexing and attackers can abuse that by providing some ReDos payload using `SmartWatch`. The maintainers removed `htmlclient/useragent` from versions 2.3.19, 2.4.7, and 2.5.0-beta.2. As a workaround, disable NginX forwarding the requests to the handler according to the directions in the GitHub Security Advisory.
Which versions are affected by CVE-2022-29169?
It affects 1 product.
Products include Bigbluebutton Bigbluebutton.
How do I fix CVE-2022-29169?
No fix has been published for CVE-2022-29169 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-29169 being exploited?
There is no known exploitation of CVE-2022-29169 in the wild and no public exploit code.
Other vulnerabilities in bigbluebutton
Sources
Also known as GHSA-rwrv-p665-4vwp.