Skip to content

Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API

Moderate
Cyberboss published GHSA-p2xj-w57r-6f5m May 24, 2023

Package

DreamMaker API (GitHub Releases)

Affected versions

< 6.4.3

Patched versions

6.4.4
tgstation-server (GitHub Releases)
>= 4.0.0, < 5.12.2
5.12.2

Description

Impact

The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-server (TGS) restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the instance on enabled chat bots. This lasts until the instance's chat channels are updated in TGS or DreamDaemon is restarted.

TGS chat commands are unaffected, custom or otherwise.

Patches

#1493

Workarounds for Affected Versions

One of:

  • Avoid restarting TGS with an active watchdog on an instance with sensitive chat channels until updating to a patched version.
  • Update your codebase to a patched DMAPI version, perform a deployment, and have a watchdog restart triggered. Do not make deployments that roll back this change without updating TGS to a patched version.
  • Trigger a watchdog restart immediately after each time TGS is restarted with an active watchdog on an instance with sensitive chat channels.
  • Disallow your DreamMaker code from sending sensitive messages, deploy the change, and have a watchdog restart triggered. Do not make deployments that roll back this change without updating the DMAPI or TGS to a patched version.
  • Remove sensitive message enabled channels from active Chat Bots.
  • Disable or delete chat bots with sensitive channels.

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

CVE ID

CVE-2023-33198

Weaknesses

Credits