CVE-2024-41799
📋 TL;DR
This vulnerability in tgstation-server allows low-permission users with 'Set .dme Path' privilege to potentially execute malicious .dme files, which could lead to remote code execution when combined with other configuration weaknesses. It affects tgstation-server installations prior to version 6.8.0. The attack requires multiple privileges but bypasses some intended security controls.
💻 Affected Systems
- tgstation-server
📦 What is this software?
Tgstation Server by Tgstation13
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on the host server through BYOND's shell() procedure, potentially leading to full system compromise.
Likely Case
Privilege escalation within tgstation-server allowing unauthorized code execution in BYOND game servers.
If Mitigated
Limited to setting .dme paths without execution capability if proper security levels are configured.
🎯 Exploit Status
Requires authenticated low-privilege user with 'Set .dme Path' privilege, plus additional configuration weaknesses.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.8.0 and above
Vendor Advisory: https://github.com/tgstation/tgstation-server/security/advisories/GHSA-c3h4-9gc2-f7h4
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Update tgstation-server to version 6.8.0 or later. 3. Restart the tgstation-server service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Remove 'Set .dme Path' privilege from low-permission users
allRestrict the 'Set .dme Path' privilege to only trusted administrators
Disable BYOND trusted security level
allConfigure BYOND to run in untrusted mode to prevent shell() execution
🧯 If You Can't Patch
- Review and restrict user privileges, especially 'Set .dme Path' and deployment code source control
- Implement strict file upload controls and monitor for malicious .dme file uploads
🔍 How to Verify
Check if Vulnerable:
Check tgstation-server version and verify it's below 6.8.0Check Version:
tgs --version or check server configuration/interfaceVerify Fix Applied:
Confirm tgstation-server version is 6.8.0 or higher📡 Detection & Monitoring
Log Indicators:
- Unauthorized .dme file path changes
- Unexpected .dme compilation attempts
- Shell command execution in BYOND logs
Network Indicators:
- Unusual outbound connections from BYOND server process
SIEM Query:
Process execution from BYOND with suspicious command-line arguments🔗 References
- https://github.com/tgstation/tgstation-server/commit/374852fe5ae306415eb5aafb2d16b06897d7afe4
- https://github.com/tgstation/tgstation-server/pull/1835
- https://github.com/tgstation/tgstation-server/security/advisories/GHSA-c3h4-9gc2-f7h4
- https://github.com/tgstation/tgstation-server/commit/374852fe5ae306415eb5aafb2d16b06897d7afe4
- https://github.com/tgstation/tgstation-server/pull/1835
- https://github.com/tgstation/tgstation-server/security/advisories/GHSA-c3h4-9gc2-f7h4
