CVE-2018-4056
published 2019-02-05CVE-2018-4056: An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially…
PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.96%
85.5th percentile
An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| coturn_project | coturn | < 4.5.0.9 | 4.5.0.9 |
| coturn_project | coturn | >= 0 < 4.5.1.0-1 | 4.5.1.0-1 |
| coturn_project | coturn | >= 0 < 4.5.1.0-1 | 4.5.1.0-1 |
| coturn_project | coturn | >= 0 < 4.5.1.0-1 | 4.5.1.0-1 |
| coturn_project | coturn | >= 0 < 4.5.1.0-1 | 4.5.1.0-1 |
| debian | coturn | < coturn 4.5.1.0-1 (bookworm) | coturn 4.5.1.0-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| talos | coturn | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
Snort Rules: 48456 - 48458
- →SQL injection via crafted username field in the coTURN administrator web portal login — monitor for SQL metacharacters or injection payloads in the username parameter of TURN admin portal login requests. ↗
- →Exploitation is triggered via the external (internet-facing) interface of the TURN server — alert on unexpected or unauthenticated access to the coTURN admin web portal from external IPs. ↗
- ·All coTURN versions prior to 4.5.0.9 are vulnerable; upgrade to 4.5.0.9 or later (Debian fix: 4.5.1.0-1) to remediate. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c3pf-948r-8592: An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4
ghsa_unreviewed·2022-05-13
CVE-2018-4056 [CRITICAL] CWE-89 GHSA-c3pf-948r-8592: An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4
An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.
OSV
CVE-2018-4056: An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4
osv·2019-02-05·CVSS 9.8
CVE-2018-4056 [CRITICAL] CVE-2018-4056: An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4
An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.
Debian
CVE-2018-4056: coturn - An exploitable SQL injection vulnerability exists in the administrator web porta...
vendor_debian·2018·CVSS 9.8
CVE-2018-4056 [CRITICAL] CVE-2018-4056: coturn - An exploitable SQL injection vulnerability exists in the administrator web porta...
An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.
Scope: local
bookworm: resolved (fixed in 4.5.1.0-1)
bullseye: resolved (fixed in 4.5.1.0-1)
forky: resolved (fixed in 4.5.1.0-1)
sid: resolved (fixed in 4.5.1.0-1)
trixie: resolved (fixed in 4.5.1.0-1)
No detection rules found.
No public exploits indexed.
Talos
Vulnerability Spotlight: Multiple vulnerabilities in coTURN
blogs_talos·2019-01-29·CVSS 9.8
[CRITICAL] Vulnerability Spotlight: Multiple vulnerabilities in coTURN
Nicolas Edet of Cisco discovered these vulnerabilities.
### Executive summary
Today, Cisco Talos is disclosing three vulnerabilities in coTURN. coTURN is an open-source implementation of TURN and STUN servers that can be used as a general-purpose networking traffic TURN server. TURN servers are usually deployed in so-called “DMZ” zones — any server reachable from the internet — to provide firewall traversal solutions.
In accordance with our coordinated disclosure policy, Cisco Talos worked with coTURN to ensure that these issues are resolved and that an update is available for affected customers.
### Vulnerability details
coTURN administrator web portal SQL injection vulnerability (TALOS-2018-0730/CVE-2018-4056)
An exploitable SQL injection vulnerability exists in the administrator w
Talos
Vulnerability Spotlight: Multiple vulnerabilities in coTURN
blogs_talos·2019-01-29·CVSS 9.8
[CRITICAL] Vulnerability Spotlight: Multiple vulnerabilities in coTURN
## Vulnerability Spotlight: Multiple vulnerabilities in coTURN
Nicolas Edet of Cisco discovered these vulnerabilities.
## Executive summary
Today, Cisco Talos is disclosing three vulnerabilities in coTURN. coTURN is an open-source implementation of TURN and STUN servers that can be used as a general-purpose networking traffic TURN server. TURN servers are usually deployed in so-called “DMZ” zones — any server reachable from the internet — to provide firewall traversal solutions. In accordance with our coordinated disclosure policy, Cisco Talos worked with coTURN to ensure that these issues are resolved and that an update is available for affected customers.
## Vulnerability details
coTURN administrator web portal SQL injection vulnerability (TALOS-2018-0730/CVE-2018-4056) An exploitab
https://lists.debian.org/debian-lts-announce/2019/02/msg00017.htmlhttps://talosintelligence.com/vulnerability_reports/TALOS-2018-0730https://www.debian.org/security/2019/dsa-4373https://lists.debian.org/debian-lts-announce/2019/02/msg00017.htmlhttps://talosintelligence.com/vulnerability_reports/TALOS-2018-0730https://www.debian.org/security/2019/dsa-4373
2019-02-05
Published