processone / stun / 111

52%

master: 52%

push

github

Fix TURN nonce reuse from different source addresses

Bind TURN nonces to the client's source address to prevent nonce reuse
attacks. Previously, an attacker could obtain a valid nonce from their
own IP address and reuse it in requests sent from a different (potentially
spoofed) source address, enabling creation of spoofed TURN allocations.

This vulnerability has existed since TURN support was first added in
version 0.9.0 (May 2014).

Severity: Medium (CVSS 3.1: 5.9)
CWE-287: Improper Authentication
CWE-346: Origin Validation Error

Thanks to Christoph Sanders for reporting the issue.

18 of 18 new or added lines in 2 files covered. (100.0%)

681 of 1202 relevant lines covered (56.66%)

2.88 hits per line