PT-2024-23863 · Sunshine · Sunshine

Matheusjcastro · Published 2024-04-08 · Updated 2024-04-08 · CVE-2024-31221

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Sunshine versions 0.10.0 through 0.22.x

Description The issue affects Sunshine, a self-hosted game stream host for Moonlight. After unpairing all devices in the web UI interface and then pairing only one device, all of the previously paired devices will be temporarily paired. This issue is resolved in version 0.23.0. As a workaround, restarting Sunshine after unpairing all devices prevents the issue.

Recommendations For versions 0.10.0 through 0.22.x, update to version 0.23.0 to resolve the issue. As a temporary workaround for versions 0.10.0 through 0.22.x, consider restarting Sunshine after unpairing all devices to prevent the issue.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2024-31221

GHSA-V8GW-JW28-V55M

Affected Products

Sunshine

References · 9

• 🔥 https://github.com/LizardByte/Sunshine/issues/2305 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31221.json · Exploit
• https://github.com/LizardByte/Sunshine/commit/b7aa8119f1471844dccdf73a8b6f7efc9baddb5e · Patch
• https://github.com/LizardByte/Sunshine/security/advisories/GHSA-v8gw-jw28-v55m · Vendor Advisory
• https://github.com/LizardByte/Sunshine/pull/2365 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-31221 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31221 · Vendor Advisory
• https://t.me/cvenotify/76058 · Telegram Post
• https://twitter.com/CVEnew/status/1777356509435113559 · Twitter Post