CVE-2018-6849 in DuckDuckGo
Summary
by MITRE
In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/15/2025
The vulnerability identified as CVE-2018-6849 resides within the WebRTC implementation of DuckDuckGo browser version 4.2.0, representing a significant privacy and security risk. This flaw manifests when users visit malicious websites that attempt to enumerate comprehensive client information, specifically targeting the disclosure of private IP addresses through STUN (Session Traversal Utilities for NAT) requests. The issue stems from improper handling of WebRTC functionality that should normally be restricted to prevent such information leakage while maintaining the browser's core functionality.
The technical mechanism behind this vulnerability involves the WebRTC protocol's inherent design for establishing peer-to-peer connections, which relies on STUN servers to discover public IP addresses for NAT traversal. However, the implementation in DuckDuckGo 4.2.0 fails to adequately sandbox or restrict these requests, allowing malicious websites to trigger STUN queries that inadvertently expose the user's private IP address. This occurs because the browser does not properly implement the necessary network isolation measures that should prevent external sites from accessing internal network information through WebRTC channels. The flaw aligns with CWE-200, which addresses improper information exposure, and specifically relates to the improper handling of network communication protocols within browser environments.
The operational impact of this vulnerability extends beyond simple IP address disclosure, creating potential attack vectors for adversaries seeking to map internal network structures or conduct location-based attacks. When a private IP address is exposed through STUN requests, it can be used in conjunction with other reconnaissance techniques to identify network topology, potentially enabling more sophisticated attacks such as internal network scanning or targeted exploitation of specific network segments. This represents a direct violation of the principle of least privilege in network security, where external entities should not be able to access internal network information through browser-based protocols. The vulnerability particularly affects users who browse untrusted websites while using DuckDuckGo, as the browser's security model fails to adequately protect against information leakage through legitimate but potentially malicious WebRTC interactions.
Mitigation strategies for this vulnerability require immediate attention from DuckDuckGo developers to implement proper WebRTC sandboxing and network isolation measures. The recommended approach involves disabling or restricting STUN server access for external websites while maintaining the functionality for legitimate WebRTC operations. This includes implementing strict origin-based access controls for WebRTC APIs, configuring proper network isolation boundaries, and ensuring that all STUN requests are properly filtered through the browser's security model. Organizations should also consider implementing network-level protections such as firewall rules that block unauthorized STUN traffic and monitoring for suspicious network activity patterns that might indicate information leakage. The remediation efforts should align with ATT&CK technique T1071.004, which covers application layer protocol: DNS, as proper network boundary controls can prevent unauthorized information disclosure through protocol interactions. Additionally, users should be advised to avoid visiting untrusted websites and to keep their browser versions updated to ensure they receive the latest security patches that address such vulnerabilities in WebRTC implementations.