CVE-2023-32687
📋 TL;DR
This vulnerability allows users with the 'list chat bots' permission in tgstation-server to read chat bot connection strings without proper authorization. It affects tgstation-server versions 4.7.0 through 5.12.0. This exposes sensitive credentials that could be used to compromise chat bot integrations.
💻 Affected Systems
- tgstation-server
📦 What is this software?
Tgstation Server by Tgstation13
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain chat bot connection strings, use them to impersonate bots, send malicious messages, or gain unauthorized access to integrated services.
Likely Case
Unauthorized users access sensitive connection strings, potentially leading to credential theft and chat bot account compromise.
If Mitigated
Minimal impact with proper permission controls and credential rotation after patching.
🎯 Exploit Status
Exploitation requires authenticated access with 'list chat bots' permission. The vulnerability is straightforward to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.12.1
Vendor Advisory: https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cp
Restart Required: Yes
Instructions:
1. Backup your current configuration. 2. Update tgstation-server to version 5.12.1 or later. 3. Restart the tgstation-server service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Remove list chat bots permission
allRemove the 'list chat bots' permission from users who should not have access to connection strings.
# Use tgstation-server admin interface or API to modify user permissions
🧯 If You Can't Patch
- Immediately remove 'list chat bots' permission from all users who don't need it
- Rotate all chat bot connection credentials and invalidate old ones
🔍 How to Verify
Check if Vulnerable:
Check if running tgstation-server version 4.7.0 through 5.12.0 and if any users have 'list chat bots' permission.Check Version:
tgstation-server --versionVerify Fix Applied:
Verify version is 5.12.1 or later and test that users without proper permissions cannot view connection strings.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to chat bot endpoints
- Users viewing connection strings without proper permissions
Network Indicators:
- Unusual API calls to chat bot management endpoints
SIEM Query:
tgstation-server AND (chat_bot OR connection_string) AND permission🔗 References
- https://github.com/tgstation/tgstation-server/pull/1487
- https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.1
- https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cp
- https://github.com/tgstation/tgstation-server/pull/1487
- https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.1
- https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cp
