CyberRota Analysis
AI-GeneratedCoturn versions 4.5.2 to 4.14.0 are vulnerable when configured with the --acme-redirect option and a plaintext-TCP listener, allowing unauthenticated remote clients to exploit a signed-to-unsigned conversion flaw. This vulnerability can leak sensitive information, including TURN credentials and OAuth tokens, through a 301 redirect response that inadvertently exposes up to 870 bytes of adjacent process heap memory. Organizations using affected Coturn versions should prioritize upgrading to version 4.15.0 to mitigate the risk of data leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed→unsigned conversion. This issue is fixed in version 4.15.0.