abraxas/openmeetings-kms-unauthApache OpenMeetings 9.1.0 - High - Remote - Unauth KMS - docs docker publishes Kurento JSON-RPC on 8888
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · openmeetings-kms-unauth
Class: Unauth KMS Reach: Remote
Apache OpenMeetings 9.1.0 (9773c59e) - Apache Software Foundation
OpenMeetings Java defaults kurento.ws.url to loopback. Official InstallMediaServer.md publishes Kurento with docker -p 8888:8888. That JSON-RPC has no auth. An unauthenticated WebSocket connect plus invoke manager_ServerManager.getInfo returns Kurento 7.3.0.
| ID | no CVE yet |
| Class | Unauth KMS |
| Reach | Remote (unauthenticated JSON-RPC on published 8888) |
| CWE | CWE-306 |
| CVSS | High: 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L |
| Product | Apache OpenMeetings + Kurento 7.3.0 |
| Affected | 9.1.0 docs/docker publish of KMS 8888 |
| Auth | none on Kurento JSON-RPC |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1:18164 only. kurento/kurento-media-server:7.3.0 as the docs publish path. |
I pinned tag 9.1.0. KMS 7.3.0+ is required by that release.
Reach the published Kurento port. No Authorization header. HTTP POST is WebSocket-only (426). ws://host:8888/kurento upgrades 101.
| Method | Sink | Privilege |
|---|---|---|
Unauth ping | Kurento JSON-RPC | Recon (lab-proven): pong. |
Unauth connect | session mint | Integrity (lab-proven): sessionId with no secret. |
Unauth invoke manager_ServerManager.getInfo | ServerInfo | Recon (lab-proven): version 7.3.0, module list (chroma/core/...). |
Unauth PlayerEndpoint / RecorderEndpoint (same socket) | KMS media elements | Recon / integrity (inferred): HTTP/file fetch as the KMS UID; pipeline create/destroy. Not exercised. Lab stayed on getInfo. |
Lab-proven vs inferred: ping, connect, getInfo are lab. PlayerEndpoint SSRF / pipeline DoS are inferred from unauth JSON-RPC.
Requires: KMS published to the network the way InstallMediaServer.md shows (-p 8888:8888). OM Java default loopback is safe until that publish.
| Surface | Why |
|---|---|
OM Java kurento.ws.url default | loopback. This leftover is the docs publish, not the Java default. |
OM /openmeetings without a SID | Wicket/CXF still want a session for rooms. |
HTTP POST /kurento without Upgrade | 426. JSON-RPC is the WebSocket. |
The full apache/openmeetings:9.1.0 image starts kurento-media-server on 0.0.0.0:8888 with no JSON-RPC auth, then that container can fail catalina as nobody without JAVA_HOME. The leftover the docs teach is the standalone KMS publish. I labbed kurento/kurento-media-server:7.3.0 with 127.0.0.1:18164:8888.
cd lab
./run.sh
Loopback ws://127.0.0.1:18164/kurento. Witness last line:
SUCCESS OPENMEETINGS-KMS-UNAUTH-WITNESS
Do not publish 8888 on a public interface. Bind KMS to loopback or a private compose network. Put an auth token on the JSON-RPC (Kurento secureKms / reverse proxy). Change the install doc example away from -p 8888:8888.
Abraxas Labs - https://abraxaslabs.tech - https://github.com/abraxas - https://x.com/abraxas_null - [email protected]
Vendor: [email protected]