CVE-2021-21382
📋 TL;DR
This vulnerability in restund TURN server allows attackers to relay traffic to localhost services by manipulating TURN channel requests. Attackers can access administrative interfaces or other local services that should be private. Systems running restund with default configurations that enable the status module are affected.
💻 Affected Systems
- restund
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the TURN server and access to all local services on the host, potentially leading to lateral movement within the network.
Likely Case
Unauthorized access to restund's administrative interface, allowing attackers to list relays, drain connections, or disrupt NAT traversal services.
If Mitigated
Limited impact with proper network segmentation and firewall rules preventing relay to sensitive addresses.
🎯 Exploit Status
Exploitation requires sending specially crafted TURN requests with XOR-PEER-ADDRESS set to loopback addresses.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions with commit fixing loopback relay restriction
Vendor Advisory: https://github.com/wireapp/restund/security/advisories/GHSA-96j5-w9jq-pv2x
Restart Required: Yes
Instructions:
1. Update restund to latest version. 2. Verify loopback relay restriction is enabled. 3. Restart restund service.
🔧 Temporary Workarounds
Disable status module
allRemove or comment out status module configuration to prevent administrative interface exposure
Edit restund.conf and remove or comment lines enabling status module (typically lines with 'status' interface)
Disable TURN module
allCompletely disable TURN functionality if not required
Edit restund.conf and remove or comment 'turn' module configuration
🧯 If You Can't Patch
- Implement strict firewall rules to prevent TURN server from relaying to loopback, private, or sensitive address ranges
- Deploy TURN servers in isolated network segments with minimal connectivity to other services
🔍 How to Verify
Check if Vulnerable:
Check if restund configuration has status module enabled on localhost and TURN module is activeCheck Version:
restund -v or check package manager for installed versionVerify Fix Applied:
Verify restund version includes loopback relay restriction and test TURN relay attempts to 127.0.0.1 are rejected📡 Detection & Monitoring
Log Indicators:
- TURN relay requests to loopback addresses
- Administrative commands from unexpected sources
Network Indicators:
- TURN channel bind requests with XOR-PEER-ADDRESS set to 127.0.0.1 or other loopback addresses
SIEM Query:
source_ip=* AND dest_port=3478 AND protocol=udp AND payload_contains="XOR-PEER-ADDRESS:127.0.0.1"🔗 References
- https://docs.wire.com/understand/restund.html
- https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p
- https://github.com/wireapp/ansible-restund/blob/master/templates/restund.conf.j2#L40-L43
- https://github.com/wireapp/restund/pull/7
- https://github.com/wireapp/restund/security/advisories/GHSA-96j5-w9jq-pv2x
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0732
- https://www.rtcsec.com/post/2021/01/details-about-cve-2020-26262-bypass-of-coturns-default-access-control-protection/#further-concerns-what-else
- https://docs.wire.com/understand/restund.html
- https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p
- https://github.com/wireapp/ansible-restund/blob/master/templates/restund.conf.j2#L40-L43
- https://github.com/wireapp/restund/pull/7
- https://github.com/wireapp/restund/security/advisories/GHSA-96j5-w9jq-pv2x
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0732
- https://www.rtcsec.com/post/2021/01/details-about-cve-2020-26262-bypass-of-coturns-default-access-control-protection/#further-concerns-what-else
