The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote a…

published 2017-09-19 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-5654

cvss: 9.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 77.4%; EPSS 77.4% chance of exploitation in 30 days, percentile 99.5%
public exploits: 3; Metasploit, Exploit-DB

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzone cookie.

Patch / fix

links 1

github.com/kaltura/server@6a6d143 commit

Timeline

2017-09-12 First public exploit (Metasploit exploit/linux/http/kaltura_unserialize_cookie_rce)
2017-09-19 Published

Exploit prediction

77.42% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/linux/http/kaltura_unserialize_cookie_rce Kaltura Remote PHP Code Execution over Cookie metasploit exploit, excellent rank, 2017-09-12
EDB-43876 Kaltura - Remote PHP Code Execution over Cookie (Metasploit) remote, 2018-01-24
EDB-43028 Kaltura < 13.2.0 - Remote Code Execution webapps, 2017-10-23
telekomsecurity.github.io https://telekomsecurity.github.io/assets/advisories/20170912_kaltura-advisory.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-798 Use of Hard-coded Credentials

References

github.com /kaltura/server/commit/6a6d14328b7a1493e8c47f9565461e5f88be20c9#diff-0770640cc76112cbf77bebc604852682
third-party-advisory
exploit-db.com /exploits/43028/
exploit
exploit-db.com /exploits/43876/
exploit
telekomsecurity.github.io /assets/advisories/20170912_kaltura-advisory.txt
exploit, third-party-advisory
securityfocus.com /bid/100976
vdb-entry, third-party-advisory

Sources

CVE List CVE-2017-14143
NVD CVE-2017-14143

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary