PT-2018-13900 · Tgstation · Tgstation-Server

Cyberboss · Published 2018-09-24 · Updated 2023-06-12 · CVE-2018-17107

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tgstation-server versions 3.2.1.0 through 3.2.4.0

Description The issue allows active logins to be cached, enabling subsequent logins to succeed with any username or password. This is due to a bug in the WCF communication layer, where the authPolicy parameter is used incorrectly, causing the server to cache previously returned policies. The bug was introduced to accommodate running the Control Panel using Mono.

Recommendations For versions 3.2.1.0 through 3.2.4.0, update to version 3.2.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2018-17107

GHSA-42R6-P4PX-QVV6

GHSA-7R36-JF3C-JHP4

Affected Products

Tgstation-Server

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2018-17107 · Security Note
• https://osv.dev/vulnerability/GHSA-42r6-p4px-qvv6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7r36-jf3c-jhp4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-17107 · Vendor Advisory
• https://github.com/tgstation/tgstation-server · Note
• https://github.com/tgstation/tgstation-server/issues/690 · Note
• https://github.com/tgstation/tgstation-server/commit/2894ea03d708c7f16bab47ba5020c2ad4c3d5554#diff-0ba090ea7073a3a304dfdbdfc512f733 · Note
• https://github.com/tgstation/tgstation-server/security/advisories/GHSA-42r6-p4px-qvv6 · Note
• https://github.com/tgstation/tgstation-server/blob/tgstation-server-v3.2.5.0/TGS.Interface/TGS.Interface.nuspec · Note
• https://github.com/tgstation/tgstation-server/commit/1812a9c6793c8516c138a105ccfb2108164f0eff · Note
• https://docs.microsoft.com/en-us/dotnet/api/system.servicemodel.serviceauthenticationmanager.authenticate?view=netframework-4.7.2#System_ServiceModel_ServiceAuthenticationManager_Authenticate_System_Collections_ObjectModel_ReadOnlyCollection_System_IdentityModel_Policy_IAuthorizationPolicy__System_Uri_System_ServiceModel_Channels_Message__ · Note
• https://nuget.org/packages/TGServiceInterface · Note