CVE-2024-33850
📋 TL;DR
Pexip Infinity before version 34.1 has an improper access control vulnerability in waiting rooms. Unadmitted participants can view the conference roster and perform unauthorized actions before being granted access to the meeting. This affects all Pexip Infinity deployments running vulnerable versions.
💻 Affected Systems
- Pexip Infinity
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Unadmitted participants could disrupt meetings by performing unauthorized actions, potentially accessing sensitive participant information or interfering with meeting controls.
Likely Case
Participants in waiting rooms can see who is in the conference before being admitted, potentially revealing sensitive meeting attendance information.
If Mitigated
With proper access controls, participants only see the roster and can perform actions after being formally admitted to the meeting.
🎯 Exploit Status
Exploitation requires being placed in a waiting room, which typically requires some level of authentication to join the meeting.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 34.1
Vendor Advisory: https://docs.pexip.com/admin/security_bulletins.htm
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Upgrade to Pexip Infinity version 34.1 or later. 3. Restart services. 4. Verify functionality.
🔧 Temporary Workarounds
Disable waiting rooms
allTemporarily disable waiting room functionality to prevent exploitation
pexip_admin_cli --disable-waiting-rooms
Restrict meeting access
allUse meeting passwords and authenticated access only
🧯 If You Can't Patch
- Disable waiting room functionality entirely
- Implement strict meeting access controls with authentication requirements
🔍 How to Verify
Check if Vulnerable:
Check Pexip Infinity version via admin interface or CLI. If version is below 34.1, system is vulnerable.Check Version:
pexip_admin_cli --versionVerify Fix Applied:
After upgrade, test waiting room functionality to ensure participants cannot see roster or perform actions before admission.📡 Detection & Monitoring
Log Indicators:
- Unauthorized roster access attempts from waiting room participants
- Unexpected actions from unadmitted users
Network Indicators:
- Unusual API calls from waiting room participants to roster endpoints
SIEM Query:
source="pexip" AND (event="roster_access" OR event="unauthorized_action") AND user_status="waiting"