CVE-2021-33879
📋 TL;DR
This vulnerability allows attackers to perform man-in-the-middle attacks against Tencent GameLoop's update mechanism. By intercepting insecure HTTP connections, attackers can replace legitimate update packages with malicious executables that execute on victims' Windows machines. All GameLoop users before version 4.1.21.90 are affected.
💻 Affected Systems
- Tencent GameLoop
📦 What is this software?
Gameloop by Tencent
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary code execution, potentially leading to ransomware deployment, data theft, or persistent backdoor installation.
Likely Case
Malware installation leading to credential theft, cryptocurrency mining, or botnet enrollment.
If Mitigated
No impact if updates are secured with HTTPS and proper integrity verification.
🎯 Exploit Status
Exploitation requires MITM position but uses simple XML manipulation and MD5 spoofing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.21.90 and later
Vendor Advisory: https://www.gameloop.com
Restart Required: Yes
Instructions:
1. Open GameLoop. 2. Check for updates in settings. 3. Install version 4.1.21.90 or newer. 4. Restart GameLoop.
🔧 Temporary Workarounds
Block insecure update endpoints
windowsPrevent GameLoop from connecting to HTTP update servers via firewall rules.
netsh advfirewall firewall add rule name="Block GameLoop HTTP" dir=out action=block program="C:\Program Files\GameLoop\EmulatorShell.exe" remoteport=80 protocol=TCP
🧯 If You Can't Patch
- Disable automatic updates in GameLoop settings
- Use network monitoring to detect and block suspicious update traffic
🔍 How to Verify
Check if Vulnerable:
Check GameLoop version in settings. If version is below 4.1.21.90, system is vulnerable.Check Version:
Check 'About' section in GameLoop settings or examine installed programs in Windows Control Panel.Verify Fix Applied:
Confirm version is 4.1.21.90 or higher and verify update traffic uses HTTPS.📡 Detection & Monitoring
Log Indicators:
- GameLoop downloading executables from non-Tencent domains
- Unexpected process execution following GameLoop updates
Network Indicators:
- HTTP traffic to update servers instead of HTTPS
- Large executable downloads from unusual IPs during update checks
SIEM Query:
source="GameLoop" AND (url="http://*" OR dest_port=80) AND file_type="exe"