Publish/play bypass authorization when server configures only on_shared_object_auth_cb

[cursor]

Severity

Medium (authorization bypass)

Attacker

Any network peer that can complete RTMP handshake and connect against a server using the built-in relay.

Controlled input

AMF0 connect → createStream → publish or play commands.

Attack path

Conn::handle_command() only cross-gates publish/play against on_publish_cb, on_play_cb, on_media_cb, and on_frame_cb. When an integrator configures only on_shared_object_auth_cb (expecting shared-object admission control to imply a secured server), publish/play succeed without calling any publish/play authorization hook. The peer can claim a publish route and stream or subscribe via the built-in relay while shared objects remain gated separately in handle_amf3_shared_object().

Impact

• Unauthorized publisher can squat routes and inject media into the relay/cache.
• Unauthorized player can subscribe to relayed streams.
• Legitimate publishers can be blocked until route timeout/eviction.

Location

src/session/conn.rs

Remediation

Treat on_shared_object_auth_cb like on_media_cb/on_frame_cb: reject publish/play when only specialized callbacks are configured unless on_publish_cb/on_play_cb is also set.