CVE-2021-4020

What it actually does

The vulnerability permits injection of attacker-controlled JavaScript into dynamically generated web pages served by the Janus WebRTC gateway because user-supplied input is not properly sanitized or escaped before being placed in HTML context.

Why it matters to the business

Successful exploitation can allow theft of session tokens or credentials from administrators or users of the gateway's web interface, potentially leading to unauthorized control of video-conferencing sessions or exposure of sensitive call metadata.

How an attack unfolds

An attacker supplies a crafted string containing a script tag or event handler through a parameter that is later rendered in a web page without escaping; when an authenticated user views the affected page the script executes in their browser with the same origin as the gateway.

How to fix it

Upgrade meetecho/janus-gateway to the commit d3fc00ec803d6c41d8f98908732f44e7f4911a1c or later; if an immediate upgrade is not possible, apply input sanitization or output escaping on all web-facing parameters.

How to confirm the fix worked

Confirm the running binary or source tree contains commit d3fc00ec803d6c41d8f98908732f44e7f4911a1c; re-test previously vulnerable input fields with benign XSS probe strings to verify they are now escaped.

Typical attack path

1. Locate a Janus-gateway instance exposing its web interface
2. Identify an input field or query parameter that is reflected in HTML output
3. Craft and submit a payload containing executable JavaScript
4. Induce a legitimate user or administrator to load the resulting page
5. Execute actions in the victim's browser such as token exfiltration or session takeover

How to detect it

Inspect web access logs for requests containing script tags, onerror handlers, or javascript: URIs directed at Janus endpoints; review browser console or proxy logs for unexpected script execution originating from the gateway origin.

• <script>
• onerror=
• javascript:
• data:text/html

What your security team should do

• Apply the listed commit immediately given the public exploit maturity
• Add the gateway's web interface to the organization's regular vulnerability scanning schedule
• Review and enforce Content-Security-Policy headers on all Janus web endpoints
• Audit any custom web pages or plugins that consume Janus data for similar reflection issues