CVE-2024-39840
📋 TL;DR
This vulnerability allows a malicious Factorio server to execute arbitrary code on connecting clients through specially crafted custom maps. Attackers can exploit Lua base module functions to execute bytecode and create fake objects, leading to remote code execution. All Factorio clients connecting to untrusted servers are affected.
💻 Affected Systems
- Factorio
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of client systems with attacker gaining full control, data theft, and lateral movement capabilities.
Likely Case
Attackers create malicious servers to compromise players' systems, potentially stealing credentials, installing malware, or using systems for cryptocurrency mining.
If Mitigated
Limited impact if clients only connect to trusted servers and have network segmentation preventing lateral movement.
🎯 Exploit Status
Exploitation requires creating a malicious server with custom map. Technical details and proof-of-concept are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.101
Vendor Advisory: https://factorio.com/blog/post/fff-400
Restart Required: Yes
Instructions:
1. Launch Factorio game client. 2. Check for updates in the game launcher. 3. Update to version 1.1.101 or later. 4. Restart the game client.
🔧 Temporary Workarounds
Restrict Server Connections
allOnly connect to trusted Factorio servers from known sources. Avoid joining random public servers.
Network Segmentation
allIsolate gaming systems from critical network segments to limit lateral movement if compromised.
🧯 If You Can't Patch
- Disable multiplayer functionality and only play single-player mode
- Use network firewalls to block outgoing connections to Factorio servers (default port 34197)
🔍 How to Verify
Check if Vulnerable:
Check Factorio version in game launcher or main menu. If version is below 1.1.101, system is vulnerable.Check Version:
On Windows: Check game launcher or Factorio.exe properties. On Linux: factorio --versionVerify Fix Applied:
Confirm version is 1.1.101 or higher in game launcher or main menu.📡 Detection & Monitoring
Log Indicators:
- Unusual Lua bytecode execution in game logs
- Connection attempts to unknown Factorio servers
Network Indicators:
- Outbound connections to Factorio servers on port 34197 from unexpected systems
- Large or unusual data transfers during game sessions
SIEM Query:
source="factorio.log" AND ("bytecode" OR "custom map" OR "Lua execution")