CVE-2023-34561
📋 TL;DR
A buffer overflow vulnerability in Geometry Dash's level parsing code allows attackers to execute arbitrary code by tricking users into loading malicious levels. This affects all users running vulnerable versions of Geometry Dash, particularly those who download and play user-created levels from untrusted sources.
💻 Affected Systems
- RobTop Games AB Geometry Dash
📦 What is this software?
Geometry Dash by Robtopgames
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the victim's computer, enabling data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Attackers create malicious levels that execute code when loaded, potentially stealing game credentials, installing malware, or joining botnets.
If Mitigated
With proper network segmentation and application sandboxing, impact limited to game data corruption or temporary system instability.
🎯 Exploit Status
Multiple public proof-of-concept exploits and demonstration videos exist. Exploitation requires user interaction to load malicious level files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.2 or later
Vendor Advisory: https://www.robtopgames.com/
Restart Required: Yes
Instructions:
1. Launch Geometry Dash. 2. Check for updates in the game menu. 3. Download and install v2.2 or later. 4. Restart the game.
🔧 Temporary Workarounds
Disable User Level Downloads
allPrevent downloading and loading user-created levels from untrusted sources
Application Sandboxing
windowsRun Geometry Dash in a sandboxed environment to limit potential damage
🧯 If You Can't Patch
- Disconnect vulnerable systems from the internet and restrict level file transfers
- Implement strict application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check Geometry Dash version in game settings or application properties. Versions 2.113 and earlier are vulnerable.Check Version:
Not applicable - check version in game interfaceVerify Fix Applied:
Confirm version is 2.2 or later in game settings. Test loading known safe levels to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Geometry Dash executable
- Memory access violations in application logs
Network Indicators:
- Unexpected outbound connections from Geometry Dash process
- Downloads of level files from untrusted sources
SIEM Query:
Process Creation where Parent Process contains 'GeometryDash.exe' AND Command Line contains unusual parameters🔗 References
- https://github.com/meltah/gd-rce
- https://www.youtube.com/watch?v=DMxucOWfLPc
- https://www.youtube.com/watch?v=RGMeWPchScg
- https://www.youtube.com/watch?v=ev0VXbiduuQ
- https://www.youtube.com/watch?v=kAeJvY6BBps
- https://www.youtube.com/watch?v=u7eXBr4HkKQ
- https://github.com/meltah/gd-rce
- https://www.youtube.com/watch?v=DMxucOWfLPc
- https://www.youtube.com/watch?v=RGMeWPchScg
- https://www.youtube.com/watch?v=ev0VXbiduuQ
- https://www.youtube.com/watch?v=kAeJvY6BBps
- https://www.youtube.com/watch?v=u7eXBr4HkKQ
