CVE-2021-35491 Explained : Impact and Mitigation

A Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user account via the /enginemanager/server/user/delete.htm userName parameter. The application does not implement a CSRF token for the GET request. This issue was resolved in Wowza Streaming Engine release 4.8.14.

Understanding CVE-2021-35491

This CVE-2021-35491 discloses a CSRF vulnerability in Wowza Streaming Engine that could result in the deletion of a user account by an attacker without proper authorization.

What is CVE-2021-35491?

CVE-2021-35491 is a CSRF vulnerability in Wowza Streaming Engine versions up to 4.8.11+5 that enables an unauthorized user to delete user accounts through a specific parameter without the necessary CSRF protection.

The Impact of CVE-2021-35491

The impact of this vulnerability includes the potential unauthorized deletion of user accounts within the affected Wowza Streaming Engine versions, leading to potential data loss and security risks.

Technical Details of CVE-2021-35491

The technical details of CVE-2021-35491 include:

Vulnerability Description

The vulnerability exists in the handling of the userName parameter in the /enginemanager/server/user/delete.htm endpoint, allowing attackers to delete user accounts without proper validation.

Affected Systems and Versions

Wowza Streaming Engine versions up to 4.8.11+5 are affected by this CSRF vulnerability.

Exploitation Mechanism

Attackers can exploit this vulnerability by sending a crafted request to the specific endpoint without the necessity of a CSRF token, leading to unauthorized user account deletions.

Mitigation and Prevention

To mitigate the risks associated with CVE-2021-35491, follow these security practices:

Immediate Steps to Take

Update Wowza Streaming Engine to version 4.8.14 or the latest release that addresses this CSRF vulnerability.
Implement CSRF tokens and protection mechanisms in your applications to prevent CSRF attacks.

Long-Term Security Practices

Regularly monitor for security updates and patches released by Wowza for Streaming Engine.
Conduct security assessments and penetration testing to identify and address potential vulnerabilities.

Patching and Updates

Stay informed about security advisories and updates provided by Wowza Streaming Engine to promptly apply patches that mitigate CSRF vulnerabilities like CVE-2021-35491.