Login Sign Up

CVE-2021-32920

7.5 HIGH
Denial of Service

📋 TL;DR

CVE-2021-32920 is a denial-of-service vulnerability in Prosody XMPP server where an attacker can cause uncontrolled CPU consumption by flooding the server with SSL/TLS renegotiation requests. This affects Prosody servers running vulnerable versions, potentially making them unresponsive to legitimate users.

💻 Affected Systems

Products:
  • Prosody XMPP Server
Versions: All versions before 0.11.9
Operating Systems: All operating systems running Prosody
Default Config Vulnerable: ⚠️ Yes
Notes: All Prosody installations with SSL/TLS enabled are vulnerable. The vulnerability is in the SSL/TLS handling code.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Prosody by Prosody

View all CVEs affecting Prosody →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service outage where the Prosody server becomes unresponsive due to 100% CPU utilization, disrupting all XMPP communications for users.

🟠

Likely Case

Degraded server performance causing connection timeouts, message delays, and intermittent service disruptions for XMPP clients.

🟢

If Mitigated

Minimal impact with proper rate limiting and network controls in place to limit connection attempts.

🌐 Internet-Facing: HIGH - Internet-facing Prosody servers are directly exposed to attack from any external source.
🏢 Internal Only: MEDIUM - Internal servers are still vulnerable but attack surface is limited to internal network access.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation requires only the ability to establish SSL/TLS connections to the server. Attack tools for SSL/TLS renegotiation floods are publicly available.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 0.11.9

Vendor Advisory: https://blog.prosody.im/prosody-0.11.9-released/

Restart Required: Yes

Instructions:

1. Backup current configuration. 2. Stop Prosody service. 3. Update Prosody to version 0.11.9 or later using your package manager (apt-get upgrade prosody, yum update prosody, etc.). 4. Start Prosody service. 5. Verify version with 'prosodyctl about'.

🔧 Temporary Workarounds

Rate Limit SSL/TLS Connections

linux

Implement connection rate limiting at network level to reduce impact of flood attacks

iptables -A INPUT -p tcp --dport 5222 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 5222 -m state --state NEW -m recent --update --seconds 60 --hitcount 20 -j DROP

Disable SSL/TLS Renegotiation

all

Configure Prosody to disable SSL/TLS renegotiation if not required

Add 'ssl_renegotiation = false' to prosody.cfg.lua configuration file

🧯 If You Can't Patch

  • Implement network-level rate limiting for port 5222 (XMPP) and 5269 (server-to-server)
  • Use a reverse proxy or load balancer with SSL termination and DDoS protection capabilities

🔍 How to Verify

Check if Vulnerable:

Check Prosody version with 'prosodyctl about' or 'prosody --version'. If version is below 0.11.9, system is vulnerable.

Check Version:

prosodyctl about | grep 'Prosody'

Verify Fix Applied:

Run 'prosodyctl about' and confirm version is 0.11.9 or higher. Monitor CPU usage during normal operation.

📡 Detection & Monitoring

Log Indicators:

  • High frequency of SSL/TLS handshake messages in logs
  • CPU usage spikes in system logs
  • Connection timeouts and errors in XMPP client logs

Network Indicators:

  • Unusual high volume of SSL/TLS handshake packets to port 5222/5269
  • Multiple rapid SSL/TLS renegotiation requests from single IPs

SIEM Query:

source="prosody.log" AND ("SSL handshake" OR "TLS handshake") | stats count by src_ip | where count > 100

📊 Metadata

CVE ID: CVE-2021-32920
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: May 13, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON