CyberRota Analysis
AI-GeneratedCoturn versions prior to 4.13.1 are vulnerable due to a flaw in the good_peer_addr() function, which fails to properly canonicalize certain IPv4-compatible and NAT64 address forms. This oversight allows authenticated clients to bypass restrictions on denied IP ranges, potentially leading to unauthorized access to the server. Organizations using Coturn for TURN and STUN services should prioritize upgrading to version 4.13.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range() in src/client/ns_turn_ioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route. This issue is fixed in version 4.13.1.