PT-2024-23862 · Sunshine · Sunshine

Kjsman · Published 2024-04-05 · Updated 2024-04-08 · CVE-2024-31220

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Sunshine versions 0.16.0 through 0.17.x

Description Sunshine is a self-hosted game stream host for Moonlight. An attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who exposed the Sunshine configuration web user interface outside of localhost may be affected, depending on firewall configuration. To exploit the issue, an attacker could make an http/s request to the node modules endpoint if the user exposed the Sunshine config web server to the internet or the attacker is on the LAN.

Recommendations For versions 0.16.0 through 0.17.x, update to version 0.18.0 to resolve the issue. As a temporary workaround, consider blocking access to Sunshine via firewall to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-31220

GHSA-6RG7-7M3W-W5WC

Affected Products

Sunshine

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31220.json · Exploit
• https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6rg7-7m3w-w5wc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31220 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31220 · Security Note
• https://github.com/LizardByte/Sunshine/releases/tag/v0.18.0 · Note
• https://twitter.com/CVEnew/status/1776267460951347703 · Twitter Post
• https://t.me/cvenotify/75838 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1776303666292519381 · Twitter Post