AMF3 shared objects bypass authorization when server configures only on_frame_cb

[cursor]

Summary

Severity: Medium

When a Server registers on_shared_object_cb together with only on_frame_cb (and no on_shared_object_auth_cb, on_publish_cb, or on_play_cb), inbound AMF3 Shared Object messages are delivered to the host callback without per-peer authorization.

Attacker

Any network peer that completes handshake and connect.

Controlled input

RTMP AMF3 Shared Object wire payload (type 0x10).

Attack path

read_messages → handle_message → handle_amf3_shared_object in src/session/conn.rs. The cross-callback guard that drops shared objects when only on_publish_cb/on_play_cb/on_media_cb are configured omitted on_frame_cb.

Impact

Arbitrary shared-object injection into application logic (chat state, scoreboards, etc.).

Location

src/session/conn.rs

Remediation

Include on_frame_cb in the shared-object cross-callback guard, mirroring the on_media_cb fix.