Mediasoup
Monthly
SCTP state cookie forgery in mediasoup (npm 3.20.0-3.20.5, Rust crate 0.22.0-0.22.4) permits an on-path attacker to establish unauthorized SCTP associations and inject DataChannel messages as a trusted peer, violating RFC 9260 Section 5.1.3. The root cause is that cookie validation relies entirely on two hardcoded magic constants ('msworker' and 0xAD81) rather than a per-instance HMAC secret - all remaining cookie fields are attacker-controlled, and COOKIE-ECHO packets bypass verification-tag and CRC32c checks by design. No public exploit has been identified at time of analysis; real-world risk is bounded by the narrow attack surface: only PlainTransport and PipeTransport with SCTP enabled and without DTLS/SRTP are vulnerable, while the far more common WebRtcTransport path is explicitly unaffected.
SCTP state cookie forgery in mediasoup (npm 3.20.0-3.20.5, Rust crate 0.22.0-0.22.4) permits an on-path attacker to establish unauthorized SCTP associations and inject DataChannel messages as a trusted peer, violating RFC 9260 Section 5.1.3. The root cause is that cookie validation relies entirely on two hardcoded magic constants ('msworker' and 0xAD81) rather than a per-instance HMAC secret - all remaining cookie fields are attacker-controlled, and COOKIE-ECHO packets bypass verification-tag and CRC32c checks by design. No public exploit has been identified at time of analysis; real-world risk is bounded by the narrow attack surface: only PlainTransport and PipeTransport with SCTP enabled and without DTLS/SRTP are vulnerable, while the far more common WebRtcTransport path is explicitly unaffected.