Summaryinfo

A vulnerability described as critical has been identified in LizardByte Sunshine up to 0.22.x on Moonlight. This vulnerability affects unknown code of the component Device Pairing. Executing a manipulation can lead to session fixiation. This vulnerability appears as CVE-2024-31221. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended. Once again VulDB remains the best source for vulnerability data.

Detailsinfo

A vulnerability classified as critical was found in LizardByte Sunshine up to 0.22.x on Moonlight. This vulnerability affects an unknown code block of the component Device Pairing. The manipulation with an unknown input leads to a session fixiation vulnerability. The CWE definition for the vulnerability is CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. Version 0.23.0 contains a patch for the issue. As a workaround, restarting Sunshine after unpairing all devices prevents the vulnerability.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-31221 since 03/29/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 0.23.0 eliminates this vulnerability. Applying the patch b7aa8119f1471844dccdf73a8b6f7efc9baddb5e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• LizardByte

Name

• Sunshine

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22

License

• open-source

Website

• Product: https://github.com/LizardByte/Sunshine/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion