CVE-2017-14143: Kaltura Server hardcoded cookie secret enables PHP object injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and public exploit code plus very high EPSS make this an urgent patch target.

What it is

Kaltura before 13.2.0 uses a hardcoded secret in getUserzoneCookie to validate cookie signatures, so the signature check can be forged. A remote attacker can craft a userzone cookie that passes validation and triggers PHP object injection, leading to arbitrary PHP code execution. The flaw is trivially reachable over the network with no authentication or user interaction.

Impact

An unauthenticated remote attacker can execute arbitrary PHP code on the Kaltura server, gaining full control of the application and its data. This typically means server compromise, data theft, and use of the host as a pivot point.

Attack surface

Reached over the network via HTTP by sending a crafted userzone cookie; the CVSS vector shows AV:N/AC:L/PR:N/UI:N, so no authentication or user interaction is required. Any exposed Kaltura instance running a version before 13.2.0 is in scope.

Exploitation

Public exploit code exists (Exploit-DB 43028 and 43876, plus a Telekom Security advisory tagged Exploit), and EPSS is 0.774 with a 0.995 percentile, indicating very high predicted exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild campaign is documented in this record.

What to do

• Upgrade Kaltura Server to 13.2.0 or later, which removes the hardcoded cookie secret.
• If immediate upgrade is not possible, restrict network access to the Kaltura web interface to trusted networks only.
• Rotate any secrets or credentials that may have been exposed through prior compromise, and review server logs for suspicious PHP execution.
• Apply the referenced upstream commit (6a6d14328b7a1493e8c47f9565461e5f88be20c9) if backporting is required.

Detection

• Inspect HTTP requests for userzone cookies with anomalous or tampered signature values.
• Monitor web server and PHP logs for unexpected object deserialization errors or unusual PHP execution paths.
• Alert on outbound connections or process spawning from the Kaltura web server that deviate from baseline behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.