CVE-2024-45407: Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client
Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantly allow access to an unintended client rather than failing authentication due to a PIN validation error. The pairing attempt fails due to the incorrect PIN, but the certificate from the forged pairing attempt is incorrectly persisted prior to the completion of the pairing request. This allows access to the certificate belonging to the attacker.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45407?
CVE-2024-45407 is classified as a medium-severity vulnerability due to the potential for unintended client access during a man-in-the-middle attack.
How do I fix CVE-2024-45407?
To mitigate CVE-2024-45407, ensure that you are using the latest version of Lizardbyte Sunshine and review your network security practices to prevent MITM attacks.
What type of attacks can CVE-2024-45407 lead to?
CVE-2024-45407 can lead to unauthorized access by allowing an unintended client to connect if a man-in-the-middle attack is successfully executed.
Which software versions are affected by CVE-2024-45407?
CVE-2024-45407 affects Lizardbyte Sunshine version 2024-05-27.
How can the pairing process in Sunshine be exploited due to CVE-2024-45407?
The pairing process in Sunshine can be exploited through a man-in-the-middle attack that circumvents PIN validation, allowing access to an unauthorized client.