CyberRota Analysis
AI-GeneratedThe vulnerability lies in the `RtspMethods.valueOf()` function, which improperly handles trailing control bytes in RTSP method tokens, allowing an attacker to send malformed requests that are incorrectly interpreted as valid commands. This can lead to unauthorized actions being executed on the server, as the application cannot differentiate between legitimate and tampered requests. Organizations utilizing Netty-based RTSP servers should prioritize addressing this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.