Jitsi: Bridge Message Spoofing due to Improper JSON Handling leads to Prototype Pollution

Summary

The Jitsi VideoBridge failed to properly handle JSON messages with duplicate colibriClass keys, enabling clients to send messages interpreted differently by the bridge and resulting in unauthorized actions within video conferences.

Jitsi Security Advisory has been published: https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2023-0001.md

Changes:

• (lib-jitsi-meet) fix(misc) use safeJsonParse from js-utils
  • https://github.com/jitsi/lib-jitsi-meet/pull/2332
• (jitsi-meet) fix(misc) use safeJsonParse from js-utils
  • https://github.com/jitsi/jitsi-meet/pull/13673
• (jitsi-videobridge) ref: Cleanup BridgeChannelMessage (remove unnecessary type field).
  • https://github.com/jitsi/jitsi-videobridge/pull/2039

We thank @afewgoats for submitting this report to us.

Video call participants use a WebSocket to send and receive JSON messages via the Jitsi Videobridge. Participants can only send certain message types (endpoint statistics). The other message types (e.g. set video sources and other control messages) can only be sent by the server.

This vulnerability allowed participants to send any message type by sending JSON containing a duplicate key.

{"colibriClass":"EndpointStats","colibriClass":"ForwardedSources",...}

Videobridge, using Jackson, determines the message type from the first colibriClass value. If it is an allowed type, the message is forwarded to participants. Upon receiving the forwarded message, the clients, parsing JSON with JavaScript, determine the message type from the last colibriClass value and act on it. This may be a server-only message type.

Overall, while it's a fun bug, the impact was mainly limited to DoS against targeted participants and swapping video sources around.