CVE-2026-27624

Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip" and/or default loopback restrictions. CVE-2020-26262 addressed bypasses involving "0.0.0.0", "[::1]" and "[::]", but IPv4-mapped IPv6 is not covered. When sending a "CreatePermission" or "ChannelBind" request with the "XOR-PEER-ADDRESS" value of "::ffff:127.0.0.1", a successful response is received, even though "127.0.0.0/8" is blocked via "denied-peer-ip". The root cause is that, prior to the updated fix implemented in version 4.9.0, three functions in "src/client/ns_turn_ioaddr.c" do not check "IN6_IS_ADDR_V4MAPPED". "ioa_addr_is_loopback()" checks "127.x.x.x" (AF_INET) and "::1" (AF_INET6), but not "::ffff:127.0.0.1." "ioa_addr_is_zero()" checks "0.0.0.0" and "::", but not "::ffff:0.0.0.0." "addr_less_eq()" used by "ioa_addr_in_range()" for "denied-peer-ip" matching: when the range is AF_INET and the peer is AF_INET6, the comparison returns 0 without extracting the embedded IPv4. Version 4.9.0 contains an updated fix to address the bypass of the fix for CVE-2020-26262.

Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block loopback and internal ranges using "denied-peer-ip" and/or default loopback restrictions. CVE-2020-26262 addressed bypasses involving "0.0.0.0", "[::1]" and "[::]", but IPv4-mapped IPv6 is not covered. When sending a "CreatePermission" or "ChannelBind" request with the "XOR-PEER-ADDRESS" value of "::ffff:127.0.0.1", a successful response is received, even though "127.0.0.0/8" is blocked via "denied-peer-ip". The root cause is that, prior to the updated fix implemented in version 4.9.0, three functions in "src/client/ns_turn_ioaddr.c" do not check "IN6_IS_ADDR_V4MAPPED". "ioa_addr_is_loopback()" checks "127.x.x.x" (AF_INET) and "::1" (AF_INET6), but not "::ffff:127.0.0.1." "ioa_addr_is_zero()" checks "0.0.0.0" and "::", but not "::ffff:0.0.0.0." "addr_less_eq()" used by "ioa_addr_in_range()" for "denied-peer-ip" matching: when the range is AF_INET and the peer is AF_INET6, the comparison returns 0 without extracting the embedded IPv4. Version 4.9.0 contains an updated fix to address the bypass of the fix for CVE-2020-26262.

Coturn es una implementación de código abierto gratuita de servidor TURN y STUN. Coturn se configura comúnmente para bloquear rangos de loopback e internos usando 'denied-peer-ip' y/o restricciones de loopback predeterminadas. CVE-2020-26262 abordó evasiones que involucran '0.0.0.0', '[::1]' y '[::]', pero IPv6 mapeado a IPv4 no está cubierto. Al enviar una solicitud 'CreatePermission' o 'ChannelBind' con el valor 'XOR-PEER-ADDRESS' de '::ffff:127.0.0.1', se recibe una respuesta exitosa, aunque '127.0.0.0/8' está bloqueado a través de 'denied-peer-ip'. La causa raíz es que, antes de la corrección actualizada implementada en la versión 4.9.0, tres funciones en 'src/client/ns_turn_ioaddr.c' no verifican 'IN6_IS_ADDR_V4MAPPED'. 'ioa_addr_is_loopback()' verifica '127.x.x.x' (AF_INET) y '::1' (AF_INET6), pero no '::ffff:127.0.0.1'. 'ioa_addr_is_zero()' verifica '0.0.0.0' y '::', pero no '::ffff:0.0.0.0'. 'addr_less_eq()' utilizada por 'ioa_addr_in_range()' para la coincidencia de 'denied-peer-ip': cuando el rango es AF_INET y el par es AF_INET6, la comparación devuelve 0 sin extraer el IPv4 incrustado. La versión 4.9.0 contiene una corrección actualizada para abordar la evasión de la corrección para CVE-2020-26262.