Vulnerability · Published Apr 8, 2024 · Assigned by GitHub_M

CVE-2024-31221Clients removed during unpairing process may regain access if Sunshine was not restarted

Medium 5.9

In plain English

A medium-severity session fixation in Sunshine from LizardByte. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.5%top 56.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. Version 0.23.0 contains a patch for the issue. As a workaround, restarting Sunshine after unpairing all devices prevents the vulnerability.

Affected products (as reported)

Vendor	Product	Versions
LizardByte	Sunshine	>= 0.10.0, < 0.23.0

Weakness: CWE-384 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L

References

https://github.com/LizardByte/Sunshine/security/advisories/GHSA-v8gw-jw28-v55m x_refsource_CONFIRM
https://github.com/LizardByte/Sunshine/issues/2305 x_refsource_MISC
https://github.com/LizardByte/Sunshine/pull/2365 x_refsource_MISC
https://github.com/LizardByte/Sunshine/commit/b7aa8119f1471844dccdf73a8b6f7efc9baddb5e x_refsource_MISC