{"id":"GHSA-hvm9-wc8j-mgrc","aliases":[],"url":"https://o3.security/vulnerability/GHSA-hvm9-wc8j-mgrc","summary":"TShock Security Escalation Exploit","details":"### Impact\nAn issue with the way OTAPI manages client connections results in stale UUIDs remaining on `RemoteClient` instances after a player disconnects.\n\nBecause of this, if the following conditions are met a player may assume the login state of a previously connected player:\n1. The server has UUID login enabled\n2. An authenticated player disconnects\n3. A subsequent player connects with a modified client that does not send the `ClientUUID#68` packet during connection\n4. The server assigns the same `RemoteClient` object that belonged to the originally authenticated player to the newly connected player\n\n\n### Patches\nTShock 5.2.1 hotfixes this issue. A more robust fix will be made to OTAPI itself.\n\n### Workarounds\nImplement a RemoteClient reset event handler in a plugin like so:\n```csharp\npublic override void Initialize()\n{\n        On.Terraria.RemoteClient.Reset += RemoteClient_Reset;\n}\n\nprivate static void RemoteClient_Reset(On.Terraria.RemoteClient.orig_Reset orig, RemoteClient client)\n{\n\tclient.ClientUUID = null;\n        orig(client);\n}\n```\n\n","published":"2024-12-18T18:19:12Z","modified":"2024-12-18T18:46:35.452868Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"TShock","fixedVersion":"5.2.1"}],"fix":{"url":"https://github.com/Pryaxis/TShock/commit/5075997264b48e27960e3446a948ecb0ea0f5a03","label":"Pryaxis/TShock@5075997"},"references":[{"type":"WEB","url":"https://github.com/Pryaxis/TShock/security/advisories/GHSA-hvm9-wc8j-mgrc"},{"type":"WEB","url":"https://github.com/Pryaxis/TShock/commit/5075997264b48e27960e3446a948ecb0ea0f5a03"},{"type":"PACKAGE","url":"https://github.com/Pryaxis/TShock"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-18T18:46:35.452868Z"}}