Vulnerability · Published Jan 20, 2025 · Assigned by GitHub_M

CVE-2024-51738Sunshine improperly enforces pairing protocol request order

High 7.7

In plain English

A high-severity null pointer dereference in Sunshine from LizardByte. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)0.6%top 51.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pair a client by hijacking a legitimate pairing attempt. This bug may also be used by a remote attacker to crash Sunshine. This vulnerability is fixed in 2025.118.151840.

Affected products (as reported)

Vendor	Product	Versions
LizardByte	Sunshine	< 2025.118.151840

Weakness: CWE-305, CWE-476, CWE-841 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/LizardByte/Sunshine/security/advisories/GHSA-3hrw-xv8h-9499 x_refsource_CONFIRM
https://github.com/LizardByte/Sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd x_refsource_MISC