# Jitsi: Bridge Message Spoofing due to Improper JSON Handling leads to Prototype Pollution

Duplicate colibriClass JSON keys let participants smuggle server-only bridge messages, causing DoS and video source swapping in conferences.

- Payout: hidden
- Severity: medium
- Program: 8x8
- Found by: afewgoats
- Disclosed: 2024-08-26
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/2095061
- Library page: https://bugbountylibrary.com/r/h1%3A2095061
- Tags: area:web3 domain:web impact:dos impact:integrity kind:bounty platform:hackerone sev:medium tech:websocket technique:parser-differential vuln:access-control vuln:dos vuln:prototype-pollution

**Target:** Jitsi Videobridge WebSocket JSON message channel
**Root cause:** Bridge parses JSON with Jackson (first duplicate key wins) while clients parse with JavaScript (last key wins), so a message type check on one side disagrees with the other.
**Steps:**
1. Connect to the conference WebSocket as a participant.
2. Send `{"colibriClass":"EndpointStats","colibriClass":"ForwardedSources",...}` where the first value is an allowed participant type and the last is a server-only type.
3. Videobridge validates the first colibriClass and forwards the message.
4. Clients parse with JS, take the last colibriClass, and act on the server-only message type.
**How found:** Noticed the bridge and clients use different JSON parsers (Jackson vs JavaScript) and hypothesized duplicate-key handling would diverge, then tested a message with two colibriClass keys.
**Exploitation:** A participant sends a JSON message with duplicate colibriClass keys; the bridge's Jackson parser accepts the first (allowed) type and forwards it, while receiving clients' JS parser uses the last (server-only) type and executes it, enabling DoS against targeted participants and swapping video sources.
**Insight:** When a server validates a message type but clients re-parse the same JSON, test duplicate keys: parser-differential between Jackson (first-wins) and JS (last-wins) lets you pass a check on one value and act on another.