CVE-2022-23228
📋 TL;DR
CVE-2022-23228 is an improper WebRTC input validation vulnerability in Pexip Infinity that allows unauthenticated remote attackers to cause denial of service by consuming excessive resources. This affects all Pexip Infinity deployments before version 27.0, potentially disrupting video conferencing services.
💻 Affected Systems
- Pexip Infinity
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage of Pexip Infinity platform, disrupting all video conferences and collaboration services for extended periods.
Likely Case
Temporary service degradation or intermittent outages affecting some conferences until resources are restored.
If Mitigated
Minimal impact with proper rate limiting, resource monitoring, and network segmentation in place.
🎯 Exploit Status
The vulnerability requires sending malformed WebRTC packets, which is relatively straightforward for attackers with basic networking knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 27.0 and later
Vendor Advisory: https://docs.pexip.com/admin/security_bulletins.htm
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Upgrade Pexip Infinity to version 27.0 or later. 3. Restart all Pexip Infinity services. 4. Verify WebRTC functionality post-upgrade.
🔧 Temporary Workarounds
Disable WebRTC
allTemporarily disable WebRTC functionality to prevent exploitation while planning upgrade.
pexip --disable-webrtc
Implement Rate Limiting
linuxConfigure network-level rate limiting for WebRTC traffic to reduce attack surface.
iptables -A INPUT -p udp --dport 3478 -m limit --limit 100/min -j ACCEPT
iptables -A INPUT -p udp --dport 3478 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Pexip Infinity from untrusted networks
- Deploy Web Application Firewall (WAF) with WebRTC-specific rules and rate limiting
🔍 How to Verify
Check if Vulnerable:
Check Pexip Infinity version via admin interface or CLI: if version is below 27.0, system is vulnerable.Check Version:
pexip --versionVerify Fix Applied:
Verify version is 27.0 or higher and test WebRTC connections remain functional.📡 Detection & Monitoring
Log Indicators:
- Unusual WebRTC connection spikes
- Resource exhaustion warnings in system logs
- Failed WebRTC handshake attempts
Network Indicators:
- Abnormal UDP traffic on port 3478 (STUN)
- High volume of WebRTC packets from single sources
- Malformed WebRTC SDP offers
SIEM Query:
source="pexip" AND ("resource exhaustion" OR "webrtc error" OR "connection spike")