CVE-2022-31031
📋 TL;DR
CVE-2022-31031 is a critical stack buffer overflow vulnerability in PJSIP's STUN implementation that allows remote code execution. It affects PJSIP users who configure STUN servers in their applications or use the pjlib-util/stun_simple API directly. Attackers can exploit this to execute arbitrary code on affected systems.
💻 Affected Systems
- PJSIP
- pjproject
- applications using PJSIP library
📦 What is this software?
Pjsip by Teluu
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full control of the system, potentially leading to complete compromise, data theft, and lateral movement within the network.
Likely Case
Remote code execution leading to service disruption, data exfiltration, or installation of malware/backdoors.
If Mitigated
With proper network segmentation and least privilege, impact limited to the affected service container or isolated segment.
🎯 Exploit Status
No public exploit code available, but vulnerability is straightforward to exploit given the buffer overflow nature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit 450baca (2.13+ releases)
Vendor Advisory: https://github.com/pjsip/pjproject/security/advisories/GHSA-26j7-ww69-c4qj
Restart Required: Yes
Instructions:
1. Update to PJSIP version 2.13 or later. 2. Rebuild applications using the patched library. 3. Restart all affected services.
🔧 Temporary Workarounds
Disable STUN functionality
allRemove STUN server configuration from PJSIP applications to eliminate attack vector
🧯 If You Can't Patch
- Implement strict network controls to block external access to STUN services
- Deploy application-level firewalls to monitor and block suspicious STUN traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check PJSIP version and verify if STUN functionality is enabled in configurationCheck Version:
pkg-config --modversion libpjprojectVerify Fix Applied:
Verify PJSIP version is 2.13 or later and confirm STUN functionality works without crashes📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Memory access violation errors
- Unusual STUN request patterns
Network Indicators:
- Unusual STUN traffic to vulnerable ports
- Exploit pattern detection in STUN packets
SIEM Query:
source="pjsip" AND (event_type="crash" OR error="buffer_overflow")🔗 References
- https://github.com/pjsip/pjproject/commit/450baca94f475345542c6953832650c390889202
- https://github.com/pjsip/pjproject/security/advisories/GHSA-26j7-ww69-c4qj
- https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://security.gentoo.org/glsa/202210-37
- https://www.debian.org/security/2023/dsa-5358
- https://github.com/pjsip/pjproject/commit/450baca94f475345542c6953832650c390889202
- https://github.com/pjsip/pjproject/security/advisories/GHSA-26j7-ww69-c4qj
- https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
- https://security.gentoo.org/glsa/202210-37
- https://www.debian.org/security/2023/dsa-5358
