CVE-2020-28361: 
NixOS vulnerability analysis and mitigation

Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This vulnerability was discovered in the remove_hf function in the Kamailio textops module and was disclosed on November 18, 2020 (NVD).

The vulnerability occurs in the remove_hf function within the Kamailio textops module. It allows attackers to bypass header-removal protection mechanisms by exploiting whitespace characters. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, and a CVSS v2.0 Base Score of 5.5 (MEDIUM) (NVD).

The vulnerability primarily affects the integrity of the system, with moderate impact. It can allow skilled attackers with valid credentials to disrupt internal call start/duration accounting mechanisms, potentially leading to revenue loss. The vulnerability enables SIP header injection attacks that could result in toll fraud, caller-id spoofing, and authentication bypass (Sippy Support).

The vulnerability requires a skilled attacker with valid credentials in the system to exploit. Exploit code has been publicly released, as indicated by the presence of a proof-of-concept on security websites (Packet Storm).

The primary mitigation is to upgrade to Kamailio version 5.4.0 or later. For Sippy Softswitch users, specific mitigation steps vary by version: users of v5.2 can switch to OpenSIPS, while users of v5.0 and v5.1 should either update to the latest version or upgrade to v5.2 with OpenSIPS enabled. Users of v4.5 and earlier versions should contact Sippy Software support for further instructions (Sippy Support).