CVE-2020-28361 Explained : Impact and Mitigation

Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This vulnerability may enable a skilled attacker with valid credentials to disrupt internal call accounting mechanisms, potentially leading to revenue loss.

Understanding CVE-2020-28361

This CVE identifies a security vulnerability in Kamailio that could be exploited to bypass header-removal protection.

What is CVE-2020-28361?

The vulnerability in Kamailio before version 5.4.0 allows attackers to bypass header-removal protection using whitespace characters, particularly impacting Sippy Softswitch and related products.

The Impact of CVE-2020-28361

Exploiting this vulnerability could allow a skilled attacker with valid credentials to disrupt internal call accounting mechanisms, potentially resulting in financial losses.

Technical Details of CVE-2020-28361

This section provides technical insights into the vulnerability.

Vulnerability Description

The vulnerability exists in the remove_hf function in the Kamailio textops module, enabling the bypass of header-removal protection via whitespace characters.

Affected Systems and Versions

Kamailio versions before 5.4.0
Sip Express Router (SER) in Sippy Softswitch versions 4.5 through 5.2

Exploitation Mechanism

Attackers can exploit the vulnerability by utilizing whitespace characters to bypass the header-removal protection mechanism.

Mitigation and Prevention

Protecting systems from CVE-2020-28361 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update Kamailio to version 5.4.0 or newer to mitigate the vulnerability.
Monitor and audit internal call accounting mechanisms for any unusual disruptions.

Long-Term Security Practices

Regularly review and update security configurations to prevent similar vulnerabilities.
Conduct security training to educate users on recognizing and reporting suspicious activities.

Patching and Updates

Apply patches and updates provided by Kamailio to address the vulnerability and enhance system security.