CVE-2023-36993
📋 TL;DR
CVE-2023-36993 is a critical vulnerability in TravianZ game servers where the password reset function uses a cryptographically insecure random number generator. This allows attackers to predict password reset tokens and take over user accounts. All TravianZ servers running affected versions are vulnerable.
💻 Affected Systems
- TravianZ
📦 What is this software?
Travianz by Travianz Project
Travianz by Travianz Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all user accounts, including administrator accounts, leading to data theft, account hijacking, and server takeover.
Likely Case
Targeted account takeover of specific users, potentially including administrators, leading to privilege escalation and data compromise.
If Mitigated
Limited impact with proper monitoring and rate limiting, though vulnerability remains exploitable.
🎯 Exploit Status
Exploitation requires predicting or brute-forcing weak random values used in password reset tokens.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a secure fork or implementing custom fixes.
🔧 Temporary Workarounds
Disable Password Reset Function
allTemporarily disable the vulnerable password reset functionality until a proper fix is implemented.
# Edit TravianZ configuration to disable password reset
Implement Rate Limiting
allAdd rate limiting to password reset requests to make brute-force attacks impractical.
# Configure web server or application rate limiting for /password-reset endpoints
🧯 If You Can't Patch
- Implement strong network-level rate limiting on password reset endpoints
- Monitor for unusual patterns of password reset requests and failed attempts
🔍 How to Verify
Check if Vulnerable:
Check if running TravianZ version 8.3.3 or 8.3.4 by examining version files or configuration.Check Version:
grep -r 'version' /path/to/travianz/ or check config filesVerify Fix Applied:
Verify that password reset tokens are generated using cryptographically secure random functions (e.g., PHP's random_bytes() or openssl_random_pseudo_bytes()).📡 Detection & Monitoring
Log Indicators:
- Unusual volume of password reset requests
- Multiple failed password reset attempts from single IP
Network Indicators:
- High frequency requests to password reset endpoints
- Patterns of sequential or predictable reset tokens
SIEM Query:
source="web_logs" AND (url="*/password-reset*" OR url="*/lostpassword*") | stats count by src_ip | where count > 10