CVE-2018-7259
📋 TL;DR
The Flight Sim Labs A320-X installer version 2.0.1.231 sends users' Google account credentials over unencrypted HTTP when pirated serial numbers are entered, allowing attackers to intercept sensitive authentication data. This affects users who installed the vulnerable version and entered invalid serial numbers. The vulnerability was removed in version 2.0.1.232.
💻 Affected Systems
- Flight Sim Labs A320-X
📦 What is this software?
A320 X by Flightsimlabs
⚠️ Risk & Real-World Impact
Worst Case
Attackers intercept Google credentials, gain unauthorized access to Google accounts, leading to identity theft, data breaches, and account takeover.
Likely Case
Credentials transmitted over HTTP are captured by network sniffers, resulting in compromised Google accounts and potential privacy violations.
If Mitigated
With proper network monitoring and HTTPS enforcement, credential interception is prevented, limiting impact to failed authentication attempts.
🎯 Exploit Status
Exploitation requires network sniffing capabilities; no authentication needed to intercept HTTP traffic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.1.232
Vendor Advisory: https://forums.flightsimlabs.com/index.php?/topic/16210-malware-in-installer/
Restart Required: No
Instructions:
1. Uninstall version 2.0.1.231. 2. Download and install version 2.0.1.232 or later from official sources. 3. Verify installation completes successfully.
🔧 Temporary Workarounds
Block HTTP traffic to installLog.flightsimlabs.com
windowsPrevents credential transmission by blocking network requests to the vulnerable endpoint.
netsh advfirewall firewall add rule name="Block FSLabs Installer" dir=out action=block remoteip=installLog.flightsimlabs.com
Use HTTPS enforcement
allConfigure network devices to block unencrypted HTTP traffic to sensitive domains.
🧯 If You Can't Patch
- Uninstall the vulnerable version immediately and avoid using pirated software.
- Monitor network traffic for HTTP requests to installLog.flightsimlabs.com and investigate any occurrences.
🔍 How to Verify
Check if Vulnerable:
Check installer version in program details or installation logs for '2.0.1.231'.Check Version:
wmic product where name="Flight Sim Labs A320-X" get versionVerify Fix Applied:
Confirm installed version is 2.0.1.232 or later and monitor network traffic for HTTP requests to the vulnerable endpoint.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to installLog.flightsimlabs.com/LogHandler3.ashx in network logs
Network Indicators:
- Cleartext HTTP traffic containing Google authentication tokens to installLog.flightsimlabs.com
SIEM Query:
destination_ip='installLog.flightsimlabs.com' AND http_method='POST' AND url_path='/LogHandler3.ashx'🔗 References
- https://forums.flightsimlabs.com/index.php?/topic/16210-malware-in-installer/
- https://medium.com/%40lukegorman97/flightsimlabs-alleged-malware-analysis-1427c4d23368
- https://www.reddit.com/r/flightsim/comments/7yh4zu/fslabs_a320_installer_seems_to_include_a_chrome/
- https://forums.flightsimlabs.com/index.php?/topic/16210-malware-in-installer/
- https://medium.com/%40lukegorman97/flightsimlabs-alleged-malware-analysis-1427c4d23368
- https://www.reddit.com/r/flightsim/comments/7yh4zu/fslabs_a320_installer_seems_to_include_a_chrome/
