CVE-2022-24754
📋 TL;DR
CVE-2022-24754 is a stack-buffer overflow vulnerability in PJSIP multimedia communication library that affects users accepting hashed digest credentials. Successful exploitation could allow remote code execution or denial of service. Only users with PJSIP_CRED_DATA_DIGEST credential type enabled are affected.
💻 Affected Systems
- PJSIP (pjproject)
- Applications using PJSIP library
📦 What is this software?
Pjsip by Teluu
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, credential theft, or persistent backdoor installation
Likely Case
Denial of service causing service disruption or application crashes
If Mitigated
Limited impact with proper input validation and credential type restrictions
🎯 Exploit Status
Exploitation requires sending specially crafted digest credentials to vulnerable endpoint
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Master branch commit d27f79da11df7bc8bb56c2f291d71e54df8d2c47 and later releases
Vendor Advisory: https://github.com/pjsip/pjproject/security/advisories/GHSA-73f7-48m9-w662
Restart Required: Yes
Instructions:
1. Update to PJSIP version after 2.12 or apply commit d27f79da11df7bc8bb56c2f291d71e54df8d2c47
2. Recompile and reinstall PJSIP library
3. Restart all services using PJSIP
🔧 Temporary Workarounds
Disable Digest Credentials
allDisable PJSIP_CRED_DATA_DIGEST credential type usage
Modify PJSIP configuration to use plaintext credentials only
Input Validation
allAdd custom validation for digest credential length before passing to PJSIP
Implement check: if (digest_length != PJSIP_MD5STRLEN) reject_credential();
🧯 If You Can't Patch
- Disable PJSIP_CRED_DATA_DIGEST credential type entirely
- Implement network segmentation to restrict access to PJSIP services
🔍 How to Verify
Check if Vulnerable:
Check if using PJSIP version ≤2.12 and PJSIP_CRED_DATA_DIGEST credential type is enabledCheck Version:
pkg-config --modversion pjproject || check library version in applicationVerify Fix Applied:
Verify PJSIP version >2.12 or check for commit d27f79da11df7bc8bb56c2f291d71e54df8d2c47 in source📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Memory access violation errors
- Failed authentication attempts with malformed credentials
Network Indicators:
- Unusual traffic to SIP authentication endpoints
- Multiple failed authentication attempts
SIEM Query:
source="pjsip" AND (event="crash" OR event="segfault" OR auth_failure_count > threshold)🔗 References
- https://github.com/pjsip/pjproject/commit/d27f79da11df7bc8bb56c2f291d71e54df8d2c47
- https://github.com/pjsip/pjproject/security/advisories/GHSA-73f7-48m9-w662
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://security.gentoo.org/glsa/202210-37
- https://github.com/pjsip/pjproject/commit/d27f79da11df7bc8bb56c2f291d71e54df8d2c47
- https://github.com/pjsip/pjproject/security/advisories/GHSA-73f7-48m9-w662
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
- https://security.gentoo.org/glsa/202210-37
