CVE-2020-11722 in Dungeon Crawl Stone Soup
Summary
by MITRE
Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/18/2024
The vulnerability identified as CVE-2020-11722 affects Dungeon Crawl Stone Soup, a popular roguelike computer game that has been in development for over a decade. This particular flaw exists in versions prior to 0.25 and represents a critical remote code execution vulnerability that could be exploited by attackers who gain the ability to upload files to the target system. The game's configuration file handling mechanism, specifically the .crawlrc file processing, serves as the attack vector for this vulnerability. The .crawlrc file is a user configuration file that stores game settings and preferences, and when improperly handled, becomes a potential pathway for malicious code execution.
The technical flaw lies in the game's insufficient validation and sanitization of Lua bytecode contained within uploaded .crawlrc files. When a user's configuration file is processed, the application loads and executes Lua scripts directly without proper sandboxing or bytecode verification mechanisms. This design flaw allows attackers to embed malicious Lua bytecode within the configuration file, which then gets executed with the privileges of the user running the game client. The vulnerability essentially enables a form of code injection where the attacker's malicious payload is interpreted and executed as legitimate game code, bypassing normal security boundaries that should protect against unauthorized code execution.
The operational impact of this vulnerability is severe as it allows remote attackers to execute arbitrary code on affected systems without requiring any special privileges or authentication. An attacker could potentially gain full control over the victim's system, including the ability to install malware, steal sensitive data, or perform other malicious activities. The vulnerability is particularly dangerous because it can be exploited through the game's normal file upload functionality, making it accessible to anyone who can interact with the game environment. This creates a significant risk for users who might unknowingly download and execute malicious configuration files from untrusted sources or when the game's file upload features are exposed to external users.
The vulnerability maps directly to CWE-94, which describes "Improper Control of Generation of Code ('Code Injection')" and aligns with ATT&CK technique T1059.007 for "Command and Scripting Interpreter: Lua". The attack surface is expanded through the game's network features and file sharing capabilities that allow users to exchange configuration files. Security practitioners should consider this vulnerability in the context of the broader software supply chain attack vectors, as it demonstrates how legitimate application features can be weaponized for malicious purposes. The remediation approach requires implementing proper input validation and code execution sandboxing for all user-provided script content, ensuring that any embedded Lua bytecode is properly sanitized before execution.
Mitigation strategies should include immediate upgrading to version 0.25 or later, which contains the necessary patches to address the vulnerability. Additionally, administrators should implement network-level restrictions on file upload capabilities and monitor for suspicious .crawlrc file uploads. The game's configuration system should be audited for similar issues, and proper input validation should be enforced for all user-provided content. Organizations using this game in educational or corporate environments should consider implementing network segmentation and access controls to limit exposure. The vulnerability highlights the importance of secure coding practices in applications that process user-provided scripts, emphasizing the need for sandboxing mechanisms and strict input validation to prevent similar issues in other software applications.