This is clearly a major vulnerability and not a feature, it's a permissions/credentials hijack.
The user has given permission for audio and videos recording to the jitsi domain during a previous meeting, and the domain is using those permissions to start an unsolicited meeting initiated by a 3rd party, who is given access to the video and audio of the victim.
Jitsi dev here. We are currently revisiting this. It exists because in cases such as when Jitsi Meet is being embdeed there are pre-join pages provided externally by the "host" site. We will be limiting how this can be used going forward.
Is/will there be any discussion on how initial triage of potential security issues will be handled in the future?
It was disappointing to see the responses in the post. A curt "It's a feature" to a valid security concern & disclosure, and not replying to a request to publish.
Jitsi says "We encourage responsible disclosure for the sake of our users, so please reach out before posting in a public space.". But if no one bothers to reply, why bother to reach out to Jitsi in the first place?
https://jitsi.org/ says, literally in the hero image banner, "More secure" as the first thing you see. The handling of this raises some concerns about that. (If you don't want to be scrutinized as much about privacy & security stuff, I would recommend not advertising "more secure" as the first thing people see on the site)
config (which implicitly decides weather or not a prejoin dialog is shown)
but this makes me wonder
1. why can you set that config in a URL? Allowing users to set it for them-self seems fine, but allowing rooms or URL to use it seems ... off.
2. how many other sites have this attack surface (e.g. MS Teams) just more obscure
3. actually the moment the attacker controls JS probably *all* other video conference systems have the feature, through potentially needing a lot of additional work. In which case maybe just being straightforward and open about it is fine? But the cost of such an attack is just a very bit too low compared to other conference systems.
Matrix embedded Jitsi as their voice/video calling solution for a while, probably still does depending on what client you use. Automatically joining the call when you click the call button just makes sense from a UX perspective.
That said, I can't think of a reason why you'd want to permit it outside of very specific containers. Useful for integration, but outright bad design for a public instance.
if it's embedded in another service and you already clicked join etc. through that other service to name one UX flow where an additional pre-join dialog would be not supper wanted
I e.g. would not complain if MS Teams (I have to use for work) would not put me into a pre join dialog every time I click join in Outlook but just joins me with mic muted/camera disabled by default. But then it also wouldn't be a security issue in my case as I put MS Teams and co. into it's own browser window/process/profile (not due to concerns but more as a side effect of them refusing to even trying to work on Firefox and not wanting to miss out on the tab sync + tab group + account container and not being allowed to install arbitrary extensions which add similar functionality to chrome).
Not that I use Jitsi, but I suddenly feel more embarrassed about my number of open tabs. Some other exploit could have silently been launched long ago.
At least in Firefox, tabs recording have a pulsing red microphone on the favicon. I feel like you would have noticed, but perhaps you have so many that it is scrolled out of view?
Maybe my Mac is set to be paranoid, but can you share video without being asked to give the mic and camera permission to operate? I chat with jitsi all the time and have to give jitsi explicit permission to use the mic/camera each time.
> but can you share video without being asked to give the mic and camera permission to operate?
yes it's a browser setting to "remember mic/camera permission for given site"
to which extend this "remember" is there by default, can be disabled through system config/MDA etc. is probably very
lastly iff that is a default for Safari on Mac I wouldn't be surprised if that was not only placed their to protect your safety but to annoy you and push you to use Mac, it would fit into a sad list of similar things done by Apple to push people to go through their app store. But then more safe is still more better for many users.
Generally no - cross origin iframes don't allow camera/audio by default. Even if the toplevel site allows it (via https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameE...), user still needs to grant permissions to toplevel site. Of course you can still use window.open and top.location.href in the iframe and use the same trick as in the article.
I mean, I get the idea that you want to skip the whole configure step for webcam/mic if it's embedded somewhere, but I still expect cam/mic to be muted on join. Isn't that what most conferencing tools do, no matter whether you get a config dialog after clicking the join link...
cornholio|7 months ago
The user has given permission for audio and videos recording to the jitsi domain during a previous meeting, and the domain is using those permissions to start an unsolicited meeting initiated by a 3rd party, who is given access to the video and audio of the victim.
graemep|7 months ago
saghul|7 months ago
qualeed|7 months ago
It was disappointing to see the responses in the post. A curt "It's a feature" to a valid security concern & disclosure, and not replying to a request to publish.
Jitsi says "We encourage responsible disclosure for the sake of our users, so please reach out before posting in a public space.". But if no one bothers to reply, why bother to reach out to Jitsi in the first place?
https://jitsi.org/ says, literally in the hero image banner, "More secure" as the first thing you see. The handling of this raises some concerns about that. (If you don't want to be scrutinized as much about privacy & security stuff, I would recommend not advertising "more secure" as the first thing people see on the site)
dathinab|7 months ago
config.prejoinConfig.enabled=false
config (which implicitly decides weather or not a prejoin dialog is shown)
but this makes me wonder
1. why can you set that config in a URL? Allowing users to set it for them-self seems fine, but allowing rooms or URL to use it seems ... off.
2. how many other sites have this attack surface (e.g. MS Teams) just more obscure
3. actually the moment the attacker controls JS probably *all* other video conference systems have the feature, through potentially needing a lot of additional work. In which case maybe just being straightforward and open about it is fine? But the cost of such an attack is just a very bit too low compared to other conference systems.
unsnap_biceps|7 months ago
jeroenhd|7 months ago
That said, I can't think of a reason why you'd want to permit it outside of very specific containers. Useful for integration, but outright bad design for a public instance.
ginking|7 months ago
dathinab|7 months ago
I e.g. would not complain if MS Teams (I have to use for work) would not put me into a pre join dialog every time I click join in Outlook but just joins me with mic muted/camera disabled by default. But then it also wouldn't be a security issue in my case as I put MS Teams and co. into it's own browser window/process/profile (not due to concerns but more as a side effect of them refusing to even trying to work on Firefox and not wanting to miss out on the tab sync + tab group + account container and not being allowed to install arbitrary extensions which add similar functionality to chrome).
markasoftware|7 months ago
WHA8m|7 months ago
3eb7988a1663|7 months ago
capitainenemo|7 months ago
Telemakhos|7 months ago
dathinab|7 months ago
yes it's a browser setting to "remember mic/camera permission for given site"
to which extend this "remember" is there by default, can be disabled through system config/MDA etc. is probably very
lastly iff that is a default for Safari on Mac I wouldn't be surprised if that was not only placed their to protect your safety but to annoy you and push you to use Mac, it would fit into a sad list of similar things done by Apple to push people to go through their app store. But then more safe is still more better for many users.
e40|7 months ago
victorbjorklund|7 months ago
firefax|7 months ago
(As in during the pandemic -- long ago in vuln times.)
I am willing to discuss it, off the record, if someone provides their signal information.
dathinab|7 months ago
it's probably also not just affecting Jitsi (in a context only looking at "proper" video conference systems)
through its exceedingly simple to archive with Jitsi
vpShane|7 months ago
spaceport|7 months ago
zaggynl|7 months ago
o11c|7 months ago
zimzi|7 months ago
unknown|7 months ago
[deleted]
goldsteinq|7 months ago
iforgotpassword|7 months ago
abdellah123|7 months ago