CVE-2024-44080
📋 TL;DR
This vulnerability in Jitsi Meet allows attackers to make clients load GIFs from arbitrary URLs by sending specially crafted messages. This affects all users of vulnerable Jitsi Meet instances who receive messages from other participants. The vulnerability enables cross-site scripting attacks through image loading.
💻 Affected Systems
- Jitsi Meet
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could load malicious content from arbitrary domains, potentially leading to session hijacking, credential theft, or malware distribution through the Jitsi Meet interface.
Likely Case
Attackers could load tracking pixels, display inappropriate content, or perform limited cross-site scripting attacks within the Jitsi Meet interface.
If Mitigated
With proper content security policies and network filtering, the impact is limited to loading images from untrusted sources without script execution.
🎯 Exploit Status
Exploitation requires sending messages to a Jitsi Meet room, which typically requires participant access. The vulnerability is simple to exploit once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.9779 and later
Vendor Advisory: https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2024-0002.md
Restart Required: Yes
Instructions:
1. Update Jitsi Meet to version 2.0.9779 or later. 2. Restart the Jitsi Meet service. 3. Verify the update was successful by checking the version.
🔧 Temporary Workarounds
Disable Giphy integration
allDisable the vulnerable Giphy image sharing functionality
Set 'disableGiphy' to true in Jitsi Meet configuration
Implement Content Security Policy
allRestrict image loading to trusted domains only
Add CSP header: img-src 'self' https://media.giphy.com
🧯 If You Can't Patch
- Implement network filtering to block image loading from untrusted domains
- Monitor for unusual image loading patterns in Jitsi Meet logs
🔍 How to Verify
Check if Vulnerable:
Check if Jitsi Meet version is below 2.0.9779 and Giphy integration is enabledCheck Version:
Check Jitsi Meet web interface or configuration files for version informationVerify Fix Applied:
Verify version is 2.0.9779 or later and test that arbitrary URL image loading is blocked📡 Detection & Monitoring
Log Indicators:
- Unusual image loading patterns
- Requests to non-Giphy domains for GIFs
- Messages with encoded URLs in image format
Network Indicators:
- HTTP requests to arbitrary domains for image files from Jitsi Meet clients
- Unusual outbound traffic patterns
SIEM Query:
source="jitsi" AND (url CONTAINS "gif" OR url CONTAINS "image") AND NOT domain IN ("media.giphy.com", "trusted-domains")