CVE-2024-31220: falha de alta gravidade em LizardByte Sunshine
Sunshine vulnerable to remote unauthenticated arbitrary file read
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.3epss 0.5%
Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who exposed the Sunshine configuration web user interface outside of localhost may be affected, depending on firewall configuration. To exploit vulnerability, attacker could make an http/s request to the `node_modules` endpoint if user exposed Sunshine config web server to internet or attacker is on the LAN. Version 0.18.0 contains a patch for this issue. As a workaround, one may block access to Sunshine via firewall.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
LizardByte · SunshineCVEs relacionadas — LizardByte Sunshine
No mesmo produto, das mais perigosas para as menos.
CVE-2024-51738HIGHSunshine improperly enforces pairing protocol request orderEPSS 0.6%CVE-2024-31221MEDIUMClients removed during unpairing process may regain access if Sunshine was not restartedEPSS 0.5%CVE-2024-45407MEDIUMSunshine has incorrect state management during pairing process may lead to incorrectly authorized clientEPSS 0.3%CVE-2026-32253CRITICALSunshine: Authentication bypass via improper client certificate validationEPSS 0.3%CVE-2025-53096MEDIUMSunshine clickjacking in the UI leads to unauthorized actions being performedEPSS 0.2%CVE-2025-53095CRITICALSunshine application-wide CSRF in the UI leads to command injection as AdministratorEPSS 0.2%