CVE-2017-14142

Vulnerability

Multiple reflected cross-site scripting (XSS) vulnerabilities exist in Kaltura versions prior to 13.2.0. The affected endpoints include server/admin_console/web/tools/bigRedButton.php, server/admin_console/web/tools/bigRedButtonPtsPoc.php, server/admin_console/web/tools/AkamaiBroadcaster.php, server/admin_console/web/tools/XmlJWPlayer.php, and server/alpha/web/lib/bigRedButtonPtsPocHlsjs.php. Unsanitized user input from the query string parameters such as partnerId, playerVersion, secret, entryId, adminUiConfId, uiConfId, streamUsername, streamPassword, streamRemoteId, and streamRemoteBackupId is directly embedded in the HTML output without proper encoding or validation [1][2][3].

Exploitation

An attacker can craft a malicious URL containing JavaScript payloads in any of the listed parameters and trick a victim into clicking it. No authentication is required to trigger the XSS on the accessible admin console tools, though some endpoints may be accessible only to certain user roles. The attacker does not need direct write access to the server; social engineering is sufficient to deliver the crafted link [1].

Impact

Successful exploitation allows the attacker to execute arbitrary HTML and JavaScript in the context of the victim's browser session. This can lead to theft of session cookies, defacement, or redirection to malicious sites. Since some of the affected pages reside in the admin console, a successful attack could also allow the attacker to perform administrative actions on behalf of a logged-in administrator, leading to broader compromise of the Kaltura instance [1].

Mitigation

Kaltura 13.2.0 was released to fix these vulnerabilities by enforcing strict input validation using functions like safeGetInput() with appropriate regex patterns [1][2][3]. Users should upgrade to version 13.2.0 or later immediately. No official workaround has been provided for older versions. If upgrading is not possible, administrators should restrict access to the admin console tools and enforce a web application firewall (WAF) rules to block malicious query strings.