CVE-2022-22845
📋 TL;DR
CVE-2022-22845 is a critical authentication bypass vulnerability in QXIP SIPCAPTURE homer-app where all installations share the same hardcoded JWT secret key. This allows attackers to forge valid authentication tokens and gain unauthorized access to HOMER 7.x systems. All customers using affected versions are vulnerable regardless of their specific configuration.
💻 Affected Systems
- QXIP SIPCAPTURE homer-app
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to access sensitive SIP call data, modify configurations, execute arbitrary code, and potentially pivot to other systems in the network.
Likely Case
Unauthorized access to SIP monitoring data, call interception, data exfiltration, and potential privilege escalation within the HOMER system.
If Mitigated
Limited impact if proper network segmentation, strict access controls, and monitoring are in place to detect anomalous authentication attempts.
🎯 Exploit Status
Exploitation is trivial - attackers can generate valid JWT tokens using the publicly known secret key without any special tools or skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.28
Vendor Advisory: https://github.com/sipcapture/homer-app/commit/7f92f3afc8b0380c14af3d0fc1c365318a2d1591
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Update homer-app to version 1.4.28 or later. 3. Restart the homer-app service. 4. Regenerate all JWT tokens as old tokens will be invalidated.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict network access to HOMER systems to only trusted IP addresses
iptables -A INPUT -p tcp --dport [HOMER_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [HOMER_PORT] -j DROP
Reverse Proxy with Authentication
allPlace HOMER behind a reverse proxy with additional authentication layer
🧯 If You Can't Patch
- Immediately isolate the HOMER system from untrusted networks and internet access
- Implement strict network monitoring for authentication attempts and JWT token usage
🔍 How to Verify
Check if Vulnerable:
Check if homer-app version is below 1.4.28 by examining package version or checking for the hardcoded JWT secret in configuration filesCheck Version:
dpkg -l | grep homer-app # Debian/Ubuntu or check package manager for your distributionVerify Fix Applied:
Verify homer-app version is 1.4.28 or later and confirm JWT tokens are now using unique, installation-specific secrets📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful logins
- Multiple JWT token generation from unusual IP addresses
- Access patterns inconsistent with normal user behavior
Network Indicators:
- JWT tokens in requests matching the known hardcoded secret pattern
- Authentication bypass attempts to HOMER endpoints
SIEM Query:
source="homer-app" AND (event="authentication" OR event="jwt") AND (status="success" FROM suspicious_ip OR token_pattern="167f0db2")🔗 References
- http://sipcapture.org
- https://github.com/sipcapture/homer
- https://github.com/sipcapture/homer-app/commit/7f92f3afc8b0380c14af3d0fc1c365318a2d1591
- https://github.com/sipcapture/homer-app/compare/1.4.27...1.4.28
- http://sipcapture.org
- https://github.com/sipcapture/homer
- https://github.com/sipcapture/homer-app/commit/7f92f3afc8b0380c14af3d0fc1c365318a2d1591
- https://github.com/sipcapture/homer-app/compare/1.4.27...1.4.28
