PT-2025-27500 · Sunshine · Sunshine

Axfla · Publicado 2025-06-30 · Atualizado 2025-08-22 · CVE-2025-53095

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Sunshine versions prior to 2025.628.4510

Description: The issue is related to a lack of protection against Cross-Site Request Forgery (CSRF) attacks in the web UI of Sunshine. This allows an attacker to create a malicious web page that can trigger unintended actions within the Sunshine application on behalf of an authenticated user. The application's design to execute OS commands enables an attacker to abuse the "Command Preparations" feature, injecting arbitrary commands that will be executed with Administrator privileges when an application is launched.

Recommendations: For versions prior to 2025.628.4510, update to version 2025.628.4510 or later to resolve the issue. As a temporary workaround, consider restricting access to the web UI of Sunshine to minimize the risk of exploitation. Avoid using the Sunshine application until the issue is resolved.

Exploit

Correção

RCE

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2026-00210

CVE-2025-53095

GHSA-39HJ-FXVW-758M

Produtos afetados

Sunshine

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53095.json · Exploit
• https://github.com/LizardByte/Sunshine/commit/738ac93a0ec1cd10412d1f339968775f53bfefe0 · Correção
• https://github.com/LizardByte/Sunshine/security/advisories/GHSA-39hj-fxvw-758m · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-53095 · Nota de Segurança
• https://t.me/cveNotify/133167 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/1939869548288540773 · Publicação no Twitter
• https://t.me/cvetracker/27480 · Publicação no Telegram
• https://t.me/cvenotify/127202 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1939886091391193106 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1939884572310724622 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-53095 · Aviso do Fabricante
• https://twitter.com/cracbot/status/1941814427860476144 · Publicação no Twitter
• https://twitter.com/jmdevlabs/status/1945263676136497617 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-00210 · Nota de Segurança