CVE-2024-41799: tgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned users
Impact What kind of vulnerability is it? Who is impacted?
Low permission users using the "Set .dme Path" privilege could potentially set malicious .dme files existing on the host machine to be compiled and executed.
These .dme files could be uploaded via tgstation-server (requiring a separate, isolated privilege) or some other means.
A server configured to execute in BYOND's trusted security level (requiring a third separate, isolated privilege OR being set by another user) could lead to this escalating into remote code execution via BYOND's shell() proc.
The ability to execute this kind of attack is a known side effect of having privileged TGS users, but normally requires multiple privileges with known weaknesses. This vector is not intentional as it does not require control over the where deployment code is sourced from and may not require remote write access to an instance's Configuration directory.
Patches Has the problem been patched? What versions should users upgrade to?
This problem is patched by pull request #1835 and fixed in versions 6.8.0 and above.
Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not give un-trusted users the Deployment permission to set a .dme path on instances.
Other sources
tgstation-server is a production scale tool for BYOND server management. Prior to 6.8.0, low permission users using the "Set .dme Path" privilege could potentially set malicious .dme files existing on the host machine to be compiled and executed. These .dme files could be uploaded via tgstation-server (requiring a separate, isolated privilege) or some other means. A server configured to execute in BYOND's trusted security level (requiring a third separate, isolated privilege OR being set by another user) could lead to this escalating into remote code execution via BYOND's shell() proc. The ability to execute this kind of attack is a known side effect of having privileged TGS users, but normally requires multiple privileges with known weaknesses. This vector is not intentional as it does not require control over the where deployment code is sourced from and may not require remote write access to an instance's Configuration directory. This problem is fixed in versions 6.8.0 and above.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41799?
CVE-2024-41799 is considered a low-severity vulnerability affecting low permission users.
Who is impacted by CVE-2024-41799?
Low permission users who can use the "Set .dme Path" privilege are impacted by CVE-2024-41799.
How do I fix CVE-2024-41799?
To fix CVE-2024-41799, upgrade the Tgstation.Server.Host and Tgstation.Server.Api packages to version 6.8.0.
What kind of attacks can be executed due to CVE-2024-41799?
Due to CVE-2024-41799, attackers can potentially compile and execute malicious .dme files.
Which software versions are affected by CVE-2024-41799?
CVE-2024-41799 affects versions from 4.0.0 up to, but not including, 6.8.0 of Tgstation.Server.Host and Tgstation.Server.Api.