PT-2025-5636 · Tshock · Tshock

Published 2025-02-03 · Updated 2025-02-03

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: TShock (affected versions not specified)

Description: This issue allows malicious clients to connect to a server without completing the connection handshake, occupying a player slot, and receiving data from the server, even if they are banned. This can lead to harassment, observation, and utilization of server resources. The problem arises because TShock checks for bans upon the Request World Data packet, which a malicious client can choose not to send, still allowing them to join the server and chat. Other clients will not be notified of their join/leave but can see them on the player list, potentially leading to chat spam and spying on packets of players within the server.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

GHSA-F8MX-CWFH-7HR2

Affected Products

Tshock

References · 4

• https://osv.dev/vulnerability/GHSA-f8mx-cwfh-7hr2 · Vendor Advisory
• https://github.com/Pryaxis/TShock · Note
• https://github.com/Pryaxis/TShock/security/advisories/GHSA-f8mx-cwfh-7hr2 · Note
• https://github.com/Pryaxis/TShock/commit/134f80f5b8eac8929aa10f518c00970700d5913d · Note