PT-2021-19937 · Unknown · Archisteamfarm

Justarchi · Published 2021-07-26 · Updated 2021-08-13 · CVE-2021-32795

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions ArchiSteamFarm versions prior to 4.3.1.0

Description ArchiSteamFarm is a C# application for idling Steam cards from multiple accounts simultaneously. A Denial of Service vulnerability exists in versions prior to 4.3.1.0, allowing an attacker to remotely crash a running instance by sending a specifically-crafted Steam chat message. The attacker needs to know the CommandPrefix in advance, but most setups use the default value. This attack does not allow the attacker to gain sensitive information or execute arbitrary commands. The issue is patched in version 4.3.1.0.

Recommendations For versions prior to 4.3.1.0, the only workaround that guarantees complete protection is running all bots with OnlineStatus of 0 (Offline), allowing ArchiSteamFarm to ignore the specifically-crafted message without attempting to interpret it. Update to version 4.3.1.0 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-32795

GHSA-5V34-4PRM-9474

Affected Products

Archisteamfarm

References · 8

• 🔥 https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-5v34-4prm-9474 · Exploit
• 🔥 https://steamcommunity.com/groups/archiasf/discussions/1/2935742047969570844 · Exploit
• https://github.com/JustArchiNET/ArchiSteamFarm/commit/4cd581ec041912cf199c5512fe6d1dcaec0594c0 · Patch
• https://osv.dev/vulnerability/CVE-2021-32795 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32795 · Security Note
• https://t.me/cvenotify/18163 · Telegram Post
• https://t.me/cibsecurity/26527 · Telegram Post
• https://t.me/cvenotify/19316 · Telegram Post