Publish/play bypass authorization when server configures only on_release_stream_cb

[cursor]

Severity

Medium (authorization bypass)

Attacker

Any network peer that can complete RTMP handshake and connect against a server using the built-in relay.

Controlled input

AMF0 connect → createStream → publish or play commands.

Attack path

Conn::handle_command() only cross-gates publish/play against on_publish_cb, on_play_cb, on_media_cb, and on_frame_cb. on_release_stream_cb is consulted only for the releaseStream command. When an integrator configures only on_release_stream_cb (intending to control route teardown after reconnects), publish/play succeed unconditionally and enable built-in relay fan-out.

Impact

• Unauthorized publisher can claim routes and stream media.
• Unauthorized player can subscribe to relayed content.
• Route squatting can deny service to legitimate publishers.

Location

src/session/conn.rs

Remediation

Treat on_release_stream_cb like other authorization-related callbacks: reject publish/play when only specialized callbacks are configured unless on_publish_cb/on_play_cb is also set.