Platform
other
Component
sunshine
Fixed in
0.16.1
CVE-2024-31220 describes an Arbitrary File Access vulnerability discovered in Sunshine, a self-hosted game stream host for Moonlight. This vulnerability allows an attacker to remotely read arbitrary files without authentication. It affects versions 0.16.0 through 0.17.9, and a patch is available in version 0.18.0.
Successful exploitation of CVE-2024-31220 allows an attacker to read sensitive files from the server hosting Sunshine. This could include configuration files, source code, or other data that could be used to compromise the system or gain further access. The vulnerability is triggered by an HTTP/S request to the node_modules endpoint, making it particularly concerning if the Sunshine configuration web user interface is exposed outside of localhost, regardless of firewall configuration. The ability to read arbitrary files represents a significant data breach risk and could lead to further exploitation of the system.
CVE-2024-31220 was publicly disclosed on April 5, 2024. There is currently no indication of active exploitation campaigns targeting this vulnerability. The vulnerability's reliance on exposing the Sunshine configuration web UI limits its potential impact, but misconfigured deployments remain at risk. No KEV listing is currently available.
Exploit Status
EPSS
0.18% (40% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-31220 is to upgrade Sunshine to version 0.18.0, which includes a patch for this vulnerability. If upgrading is not immediately feasible, restrict access to the Sunshine configuration web user interface to localhost only. Implement strict firewall rules to prevent external access to the nodemodules endpoint. Consider using a Web Application Firewall (WAF) to filter requests and block malicious attempts to access arbitrary files. After upgrading, confirm the vulnerability is resolved by attempting to access the nodemodules endpoint and verifying that access is denied.
Actualice Sunshine a la versión 0.18.0 o posterior. Como alternativa, bloquee el acceso a Sunshine a través de un firewall para evitar el acceso no autorizado a la interfaz web de configuración.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-31220 is a HIGH severity vulnerability in Sunshine versions 0.16.0 through 0.17.9 that allows an attacker to read arbitrary files without authentication if the web UI is exposed.
You are affected if you are running Sunshine versions 0.16.0 through 0.17.9 and the configuration web user interface is accessible from outside localhost.
Upgrade Sunshine to version 0.18.0. If upgrading is not possible, restrict access to the web UI to localhost and implement strict firewall rules.
There is currently no indication of active exploitation campaigns targeting CVE-2024-31220.
Refer to the Sunshine project's official website and GitHub repository for the latest advisory and security updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.