CVE-2024-52052: Wowza Streaming Engine RCE Vulnerability

CVE-2024-52052 Overview

CVE-2024-52052 affects Wowza Streaming Engine versions below 4.9.1. The vulnerability allows an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream target. This poisoning results in high-privilege remote code execution on the underlying host. The flaw is tracked under CWE-646: Reliance on File Name or Extension of Externally-Supplied File and impacts both Linux and Windows deployments of the streaming server. Wowza addressed the issue in release 4.9.1, and Rapid7 disclosed the vulnerability alongside several other issues in the same product family.

Critical Impact
Authenticated administrators can escalate management access into arbitrary code execution on the Wowza host, compromising the streaming service and any data it processes.

Affected Products

Wowza Streaming Engine versions prior to 4.9.1
Deployments on Linux platforms
Deployments on Microsoft Windows platforms

Discovery Timeline

2024-11-21 - CVE-2024-52052 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52052

Vulnerability Analysis

The vulnerability resides in the Streaming Engine Manager configuration surface, which allows administrators to define custom application properties. Wowza consumes these properties when resolving and dispatching stream targets. An authenticated administrator can craft a custom property that poisons a stream target so that Wowza executes attacker-controlled logic during normal streaming operations. Because the Streaming Engine service typically runs with elevated privileges, successful exploitation yields high-privilege code execution on the host operating system. The bug is classified under [CWE-646], which reflects unsafe reliance on externally supplied file names or references when loading executable content.

Root Cause

The root cause is insufficient validation of administrator-controlled configuration inputs feeding stream target resolution. Wowza trusts custom application properties as safe references, so a malicious value can redirect the service to load or execute unintended code paths. The design places security dependence on the administrator role rather than enforcing strict allowlists on target references and property values.

Attack Vector

Exploitation requires network access to the Streaming Engine Manager and valid administrator credentials. The attacker configures a custom application property and stages a poisoned stream target that Wowza processes. Once the streaming pipeline references the poisoned target, the server executes the attacker's payload in the context of the Wowza service account. The vulnerability is network-reachable but gated by high privileges, making credential theft, session hijacking, or insider misuse the primary abuse scenarios. See the Rapid7 disclosure for additional context on the affected configuration flow.

Detection Methods for CVE-2024-52052

Indicators of Compromise

Unexpected changes to custom application properties or stream target definitions inside Streaming Engine Manager configuration files under the Wowza installation directory
Wowza service processes spawning shells, scripting interpreters, or network utilities that are not part of normal streaming workflows
Outbound connections from the Wowza host to unfamiliar destinations shortly after administrator configuration events

Detection Strategies

Audit Streaming Engine Manager access logs for administrator sessions that modify application properties or stream targets
Monitor child processes of the Wowza Java process for command execution activity inconsistent with media serving
Compare current Wowza XML configuration files against a known-good baseline to identify unauthorized property additions

Monitoring Recommendations

Forward Wowza access, error, and manager logs to a centralized logging platform for correlation with endpoint telemetry
Alert on administrative logins to the Streaming Engine Manager from unexpected source addresses or outside change windows
Track file integrity on conf/, applications/, and other Wowza configuration directories

How to Mitigate CVE-2024-52052

Immediate Actions Required

Upgrade all Wowza Streaming Engine instances to version 4.9.1 or later using the Wowza 4.9.1 release notes
Rotate Streaming Engine Manager administrator credentials and enforce strong, unique passwords
Review recent configuration changes and revert any unauthorized custom application properties or stream targets

Patch Information

Wowza released version 4.9.1 to remediate this issue along with related vulnerabilities disclosed by Rapid7. Administrators should apply the upgrade on both Linux and Windows deployments and validate that application properties and stream targets match sanctioned baselines after the update.

Workarounds

Restrict network access to the Streaming Engine Manager interface to trusted administrative networks or VPN segments
Limit the number of accounts with Streaming Engine Manager administrator privileges and enforce multi-factor authentication where supported
Run the Wowza service under a least-privilege account rather than a highly privileged system account where operational requirements allow

bash

# Example: restrict Streaming Engine Manager (default TCP 8088) to an internal admin subnet on Linux
iptables -A INPUT -p tcp --dport 8088 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8088 -j DROP