PT-2023-29704 · Bunkum · Bunkum

Jvyden · Published 2023-10-18 · Updated 2023-10-30 · CVE-2023-45814

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bunkum versions prior to 4.2.1

Description Bunkum is an open-source protocol-agnostic request server for custom game servers. The AuthenticationService initially supported injecting IUsers, but later added support for injecting ITokens into endpoints. However, this change led to caching issues, causing cached tokens to persist after the lifetime of the request. When a token expired, downstream projects would remove the object from Realm, causing the object in the cache to be in a detached state and resulting in an exception from invalid use of IToken.User. This is a use-after-free issue, as Realm cannot manage the lifetime of the cached token. The scope of this issue is fairly limited, and it can only be exploited on a couple of endpoints given certain conditions. User interaction is required, as authenticated requests must be performed.

Recommendations To resolve the issue, update to version 4.2.1, which includes the fix to wipe the token cache after the request was handled. At the moment, there is no information about other workarounds for versions in the 4.X.X range.

Exploit

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2023-45814

GHSA-JRF2-H5J6-3RRQ

Affected Products

Bunkum

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45814.json · Exploit
• https://github.com/LittleBigRefresh/Bunkum/security/advisories/GHSA-jrf2-h5j6-3rrq · Vendor Advisory
• https://github.com/LittleBigRefresh/Bunkum/commit/6e109464ed9255f558182f001f475a378405ff76 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-45814 · Security Note
• https://osv.dev/vulnerability/GHSA-jrf2-h5j6-3rrq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45814 · Vendor Advisory
• https://github.com/LittleBigRefresh/Bunkum · Note
• https://twitter.com/CVEnew/status/1714757909304017167 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1714805021332660672 · Twitter Post