CVE-2020-26262: 
NixOS vulnerability analysis and mitigation

Coturn before version 4.5.2 contained a vulnerability where the default configuration did not allow peers to connect and relay packets to loopback addresses in the range of 127.x.x.x. However, it was discovered that when sending a CONNECT request with the XOR-PEER-ADDRESS value of 0.0.0.0, a successful response was received and subsequently, CONNECTIONBIND also received a successful response, allowing packets to be relayed to the loopback interface. The vulnerability was discovered in 2020 and patched in version 4.5.2 (GitHub Advisory).

The vulnerability stems from an implementation flaw where the server accepted 0.0.0.0 as a valid peer address. Additionally, when coturn was listening on IPv6 (default configuration), the loopback interface could also be reached using either [::1] or [::] as the peer address. The issue received a CVSS 3.1 score of 7.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The vulnerability was classified under CWE-441 (Unintended Proxy or Intermediary) and CWE-682 (Incorrect Calculation) (GitHub Advisory).

By exploiting this vulnerability, a malicious user could bypass the default loopback protection and relay packets to the loopback interface. This was possible unless specific configuration options like --denied-peer-ip=0.0.0.0 were set. Since the default configuration implied that loopback peers were not allowed, administrators might have chosen not to set the denied-peer-ip setting, leaving their systems vulnerable (GitHub Advisory).

The vulnerability could be exploited by sending a CONNECT request with specific peer addresses. When using 0.0.0.0 as the peer address, or [::1] and [::] for IPv6, an attacker could successfully bypass the loopback protection. The exploit was confirmed through testing using TURN server configurations and SOCKS5 proxy connections (GitHub Advisory).

The vulnerability was patched in Coturn version 4.5.2. The fix includes denying addresses in the address block 0.0.0.0/8, [::1] and [::] by default unless --allow-loopback-peers has been specifically configured. As a workaround for unpatched systems, administrators should explicitly deny these addresses using the --denied-peer-ip configuration option (GitHub Advisory, Fedora Update).