CVE-2018-6651: CSRF

Q: Which deployments are affected?

Deployments using uncurl versions before 0.07 are affected. Parsec versions before 140-3 are also affected because they use the vulnerable uncurl functionality.

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates network access, low attack complexity, no privileges, and required user interaction. Successful exploitation targets WebSocket API requests through insufficient Origin-header validation.

Q: What is the remediation?

Upgrade uncurl to version 0.07 or later. For Parsec, upgrade to version 140-3 or later.

Q: How can I determine whether I need to act?

Check the installed uncurl and Parsec versions. Systems running uncurl before 0.07 or Parsec before 140-3 should be treated as affected.

Published Feb 5, 2018

Updated

In the uncurlwsaccept function in uncurl.c in uncurl before 0.07, as used in Parsec before 140-3, insufficient Origin header validation (accepting an arbitrary substring match) for WebSocket API requests allows remote attackers to bypass intended access restrictions. In Parsec, this means full control over the victim's computer.

Affected Software

2 affected components

Uncurl Project Uncurl<0.07

Parsecgaming Parsec<140-3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade uncurl to a version that resolves this vulnerability.
Fixed in 0.07
Upgrade
Upgrade Parsec to a version that resolves this vulnerability.
Fixed in 140-3

Event History

Feb 5, 2018

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Data Sourced

via NVD·10:29 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are affected?

Deployments using uncurl versions before 0.07 are affected. Parsec versions before 140-3 are also affected because they use the vulnerable uncurl functionality.

What does an attacker need to exploit this issue?

The CVSS vector indicates network access, low attack complexity, no privileges, and required user interaction. Successful exploitation targets WebSocket API requests through insufficient Origin-header validation.

What is the remediation?

Upgrade uncurl to version 0.07 or later. For Parsec, upgrade to version 140-3 or later.

How can I determine whether I need to act?

Check the installed uncurl and Parsec versions. Systems running uncurl before 0.07 or Parsec before 140-3 should be treated as affected.

CVE-2018-6651: CSRF

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the remediation?

How can I determine whether I need to act?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the remediation?

How can I determine whether I need to act?