PT-2025-2912 · Sunshine · Sunshine

Mcdcam · Published 2025-01-20 · Updated 2025-01-20 · CVE-2024-51738

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sunshine versions 0.23.1 and earlier

Description Sunshine is a self-hosted game stream host for Moonlight. The pairing protocol implementation does not validate request order, making it vulnerable to a MITM attack. This potentially allows an unauthenticated attacker to pair a client by hijacking a legitimate pairing attempt. A remote attacker may also use this bug to crash Sunshine.

Recommendations For Sunshine versions 0.23.1 and earlier, update to version 2025.118.151840 or later to resolve the issue. As a temporary workaround, consider restricting access to the pairing protocol to minimize the risk of exploitation.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

CWE-841

CWE-305

Related Identifiers

CVE-2024-51738

GHSA-3HRW-XV8H-9499

Affected Products

Sunshine

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51738.json · Exploit
• https://github.com/LizardByte/Sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd · Patch
• https://github.com/LizardByte/Sunshine/security/advisories/GHSA-3hrw-xv8h-9499 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-51738 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51738 · Security Note
• https://t.me/cvenotify/107932 · Telegram Post
• https://t.me/cvedetector/15897 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1881398298646307060 · Twitter Post
• https://twitter.com/CVEnew/status/1881366196555260104 · Twitter Post