CVE-2021-33506
📋 TL;DR
CVE-2021-33506 is a configuration vulnerability in Jitsi Meet where the 'restrict_room_creation' setting is not enforced by default, allowing attackers to bypass conference moderation controls. This affects Jitsi Meet instances where room creation restrictions are intended but not properly configured. Organizations using Jitsi Meet for sensitive meetings are particularly at risk.
💻 Affected Systems
- Jitsi Meet
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could create unauthorized conference rooms, hijack existing meetings, or bypass moderation controls to disrupt sensitive discussions or expose confidential information.
Likely Case
Unauthorized users creating conference rooms that bypass organizational controls, potentially leading to meeting disruptions or unauthorized access to meeting infrastructure.
If Mitigated
With proper configuration, room creation is restricted to authorized users only, maintaining intended moderation controls.
🎯 Exploit Status
Exploitation requires understanding of Jitsi Meet configuration but does not require advanced technical skills. Attackers need access to the Jitsi instance.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.5963-1 and later
Vendor Advisory: https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2021-0001.md
Restart Required: Yes
Instructions:
1. Update Jitsi Meet to version 2.0.5963-1 or later. 2. Update jitsi-meet-prosody package. 3. Restart Jitsi services. 4. Verify restrict_room_creation is properly configured in prosody config.
🔧 Temporary Workarounds
Manual Configuration Fix
linuxManually configure restrict_room_creation setting in prosody configuration
Edit /etc/prosody/conf.avail/YOUR_DOMAIN.cfg.lua
Add or verify: 'restrict_room_creation' = true
Restart prosody: systemctl restart prosody
🧯 If You Can't Patch
- Manually configure restrict_room_creation = true in all prosody configuration files
- Implement network-level controls to restrict access to room creation endpoints
🔍 How to Verify
Check if Vulnerable:
Check Jitsi Meet version with: dpkg -l | grep jitsi-meet. If version is earlier than 2.0.5963-1, check prosody config for restrict_room_creation setting.Check Version:
dpkg -l | grep jitsi-meet | awk '{print $3}'Verify Fix Applied:
Verify version is 2.0.5963-1 or later and check that restrict_room_creation = true is present in prosody configuration files.📡 Detection & Monitoring
Log Indicators:
- Unauthorized room creation attempts in prosody logs
- Room creation events from unexpected users
Network Indicators:
- HTTP POST requests to room creation endpoints from unauthorized sources
SIEM Query:
source="prosody" AND "room creation" AND NOT user IN (authorized_users_list)🔗 References
- https://github.com/jitsi/jitsi-meet/compare/5025...5026
- https://github.com/jitsi/jitsi-meet/pull/9252/files
- https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2021-0001.md
- https://github.com/jitsi/jitsi-meet/compare/5025...5026
- https://github.com/jitsi/jitsi-meet/pull/9252/files
- https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2021-0001.md
