Description

An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration (security.enabled), SrsSecurity::check(), trunk/src/app/srs_app_security.cpp, and SRS RTMP listener components

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T20:16:45.240Z",
  "pubdate": "2026-08-17T20:16:45.240Z",
  "executiveSummary": "An arbitrary code execution vulnerability has been identified in OSSRS SRS (Simple Realtime Server) versions prior to v5.0.213. The vulnerability is situated within the RTMP publish authorization logic, specifically involving vhost-level security configurations governed by security.enabled and the SrsSecurity::check() routine located in trunk/src/app/srs_app_security.cpp, alongside the core SRS RTMP listener components.\nThis security flaw allows a remote, unauthenticated attacker to bypass intended authorization checks during the RTMP publishing phase. Successful exploitation of this vulnerability enables the adversary to achieve arbitrary code execution on the underlying host system running the affected SRS instance.\nThe impact is critical, as it compromises the confidentiality, integrity, and availability of the targeted server, potentially leading to complete system takeover. The attack requires network exposure of the RTMP listener port and leverages vulnerabilities in how the application processes security policies and input data during stream publication requests.",
  "technicalDetails": "The vulnerability stems from flawed logic within the RTMP publish authorization subsystem of OSSRS SRS (Simple Realtime Server) prior to v5.0.213. Specifically, the root cause resides in the SrsSecurity::check() function implemented in trunk/src/app/srs_app_security.cpp, which fails to properly validate and enforce security configurations defined at the vhost level via the security.enabled directive.\nThe affected components include the SRS RTMP listener and the associated security filtering modules responsible for evaluating client publishing permissions. When a remote attacker initiates an RTMP connection and issues a publish command, the SRS server invokes the security checking routines to determine if the client is authorized based on configured IP access lists or other policy parameters.\nDue to insufficient input validation and improper state handling within SrsSecurity::check(), an attacker can craft malicious RTMP payloads or manipulate connection parameters that bypass the authorization checks entirely. Because the RTMP listener is exposed directly to the network, this attack can be executed remotely without requiring prior authentication or privileged access.\nUpon successful processing of the maliciously crafted RTMP publish request, the application misinterprets the authorization status, leading to memory corruption or unsafe execution paths within the context of the SRS process. This anomalous behavior allows the attacker to inject and execute arbitrary shell commands or native machine code with the privileges of the running SRS daemon.\nPost-exploitation impact includes full control over the media server instance, potential lateral movement within the internal network, unauthorized data access, and disruption of live streaming services."
}