Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
3 vulnerabilities by JustArchiNET
CVE-2022-23627 (GCVE-0-2022-23627)
Vulnerability from cvelistv5 – Published: 2022-02-08 22:30 – Updated: 2025-04-23 19:06
VLAI?
Title
Inadequate access verification when using proxy commands in ArchiSteamFarm
Summary
ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn't adequately verify effective access of the user sending proxy (i.e. `[Bots]`) commands. In particular, a proxy-like command sent to bot `A` targeting bot `B` has incorrectly verified user's access against bot `A` - instead of bot `B`, to which the command was originally designated. This in result allowed access to resources beyond those configured, being a security threat affecting confidentiality of other bot instances. A successful attack exploiting this bug requires a significant access granted explicitly by original owner of the ASF process prior to that, as attacker has to control at least a single bot in the process to make use of this inadequate access verification loophole. The issue is patched in ASF V5.2.2.5, V5.2.3.2 and future versions. Users are advised to update as soon as possible.
Severity ?
5 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| JustArchiNET | ArchiSteamFarm |
Affected:
>= 5.2.2.2, < 5.2.2.5
Affected: >= 5.2.3.0, < 5.2.3.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:51:44.203Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-88ch-366c-5m89"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/pull/2501"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/pull/2509"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/commit/7a29d9282bdc3280db2a379c24f73916d786f9b4"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/commit/f807bdb660e75dee5a34994f2ea70970ca6d0492"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/releases/tag/5.2.2.5"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/releases/tag/5.2.3.2"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-23627",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T14:10:57.117039Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T19:06:32.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ArchiSteamFarm",
"vendor": "JustArchiNET",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.2.2.2, \u003c 5.2.2.5"
},
{
"status": "affected",
"version": "\u003e= 5.2.3.0, \u003c 5.2.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn\u0027t adequately verify effective access of the user sending proxy (i.e. `[Bots]`) commands. In particular, a proxy-like command sent to bot `A` targeting bot `B` has incorrectly verified user\u0027s access against bot `A` - instead of bot `B`, to which the command was originally designated. This in result allowed access to resources beyond those configured, being a security threat affecting confidentiality of other bot instances. A successful attack exploiting this bug requires a significant access granted explicitly by original owner of the ASF process prior to that, as attacker has to control at least a single bot in the process to make use of this inadequate access verification loophole. The issue is patched in ASF V5.2.2.5, V5.2.3.2 and future versions. Users are advised to update as soon as possible."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-08T22:30:13.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-88ch-366c-5m89"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/pull/2501"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/pull/2509"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/commit/7a29d9282bdc3280db2a379c24f73916d786f9b4"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/commit/f807bdb660e75dee5a34994f2ea70970ca6d0492"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/releases/tag/5.2.2.5"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/releases/tag/5.2.3.2"
}
],
"source": {
"advisory": "GHSA-88ch-366c-5m89",
"discovery": "UNKNOWN"
},
"title": "Inadequate access verification when using proxy commands in ArchiSteamFarm ",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-23627",
"STATE": "PUBLIC",
"TITLE": "Inadequate access verification when using proxy commands in ArchiSteamFarm "
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ArchiSteamFarm",
"version": {
"version_data": [
{
"version_value": "\u003e= 5.2.2.2, \u003c 5.2.2.5"
},
{
"version_value": "\u003e= 5.2.3.0, \u003c 5.2.3.2"
}
]
}
}
]
},
"vendor_name": "JustArchiNET"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn\u0027t adequately verify effective access of the user sending proxy (i.e. `[Bots]`) commands. In particular, a proxy-like command sent to bot `A` targeting bot `B` has incorrectly verified user\u0027s access against bot `A` - instead of bot `B`, to which the command was originally designated. This in result allowed access to resources beyond those configured, being a security threat affecting confidentiality of other bot instances. A successful attack exploiting this bug requires a significant access granted explicitly by original owner of the ASF process prior to that, as attacker has to control at least a single bot in the process to make use of this inadequate access verification loophole. The issue is patched in ASF V5.2.2.5, V5.2.3.2 and future versions. Users are advised to update as soon as possible."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863: Incorrect Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-88ch-366c-5m89",
"refsource": "CONFIRM",
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-88ch-366c-5m89"
},
{
"name": "https://github.com/JustArchiNET/ArchiSteamFarm/pull/2501",
"refsource": "MISC",
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/pull/2501"
},
{
"name": "https://github.com/JustArchiNET/ArchiSteamFarm/pull/2509",
"refsource": "MISC",
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/pull/2509"
},
{
"name": "https://github.com/JustArchiNET/ArchiSteamFarm/commit/7a29d9282bdc3280db2a379c24f73916d786f9b4",
"refsource": "MISC",
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/commit/7a29d9282bdc3280db2a379c24f73916d786f9b4"
},
{
"name": "https://github.com/JustArchiNET/ArchiSteamFarm/commit/f807bdb660e75dee5a34994f2ea70970ca6d0492",
"refsource": "MISC",
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/commit/f807bdb660e75dee5a34994f2ea70970ca6d0492"
},
{
"name": "https://github.com/JustArchiNET/ArchiSteamFarm/releases/tag/5.2.2.5",
"refsource": "MISC",
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/releases/tag/5.2.2.5"
},
{
"name": "https://github.com/JustArchiNET/ArchiSteamFarm/releases/tag/5.2.3.2",
"refsource": "MISC",
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/releases/tag/5.2.3.2"
}
]
},
"source": {
"advisory": "GHSA-88ch-366c-5m89",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-23627",
"datePublished": "2022-02-08T22:30:13.000Z",
"dateReserved": "2022-01-19T00:00:00.000Z",
"dateUpdated": "2025-04-23T19:06:32.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32795 (GCVE-0-2021-32795)
Vulnerability from cvelistv5 – Published: 2021-07-26 19:25 – Updated: 2024-08-03 23:33
VLAI?
Title
Denial of Service via Steam chat in ArchiSteamFarm
Summary
ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. In versions prior to 4.3.1.0 a Denial of Service (aka DoS) vulnerability which allows attacker to remotely crash running ASF instance through sending a specifically-crafted Steam chat message exists. The user sending the message does not need to be authorized within the bot or ASF process. The attacker needs to know ASF's `CommandPrefix` in advance, but majority of ASF setups run with an unchanged default value. This attack does not allow attacker to gain any potentially-sensitive information, such as logins or passwords, does not allow to execute arbitrary commands and otherwise exploit the crash further. The issue is patched in ASF V4.3.1.0. The only workaround which guarantees complete protection is running all bots with `OnlineStatus` of `0` (Offline). In this setup, ASF is able to ignore even the specifically-crafted message without attempting to interpret it.
Severity ?
6.5 (Medium)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| JustArchiNET | ArchiSteamFarm |
Affected:
>= 4.3.0.0, < 4.3.1.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:55.899Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-5v34-4prm-9474"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/commit/4cd581ec041912cf199c5512fe6d1dcaec0594c0"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://steamcommunity.com/groups/archiasf/discussions/1/2935742047969570844/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ArchiSteamFarm",
"vendor": "JustArchiNET",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.3.0.0, \u003c 4.3.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. In versions prior to 4.3.1.0 a Denial of Service (aka DoS) vulnerability which allows attacker to remotely crash running ASF instance through sending a specifically-crafted Steam chat message exists. The user sending the message does not need to be authorized within the bot or ASF process. The attacker needs to know ASF\u0027s `CommandPrefix` in advance, but majority of ASF setups run with an unchanged default value. This attack does not allow attacker to gain any potentially-sensitive information, such as logins or passwords, does not allow to execute arbitrary commands and otherwise exploit the crash further. The issue is patched in ASF V4.3.1.0. The only workaround which guarantees complete protection is running all bots with `OnlineStatus` of `0` (Offline). In this setup, ASF is able to ignore even the specifically-crafted message without attempting to interpret it."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-26T19:25:11.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-5v34-4prm-9474"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/commit/4cd581ec041912cf199c5512fe6d1dcaec0594c0"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://steamcommunity.com/groups/archiasf/discussions/1/2935742047969570844/"
}
],
"source": {
"advisory": "GHSA-5v34-4prm-9474",
"discovery": "UNKNOWN"
},
"title": "Denial of Service via Steam chat in ArchiSteamFarm",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-32795",
"STATE": "PUBLIC",
"TITLE": "Denial of Service via Steam chat in ArchiSteamFarm"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ArchiSteamFarm",
"version": {
"version_data": [
{
"version_value": "\u003e= 4.3.0.0, \u003c 4.3.1.0"
}
]
}
}
]
},
"vendor_name": "JustArchiNET"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. In versions prior to 4.3.1.0 a Denial of Service (aka DoS) vulnerability which allows attacker to remotely crash running ASF instance through sending a specifically-crafted Steam chat message exists. The user sending the message does not need to be authorized within the bot or ASF process. The attacker needs to know ASF\u0027s `CommandPrefix` in advance, but majority of ASF setups run with an unchanged default value. This attack does not allow attacker to gain any potentially-sensitive information, such as logins or passwords, does not allow to execute arbitrary commands and otherwise exploit the crash further. The issue is patched in ASF V4.3.1.0. The only workaround which guarantees complete protection is running all bots with `OnlineStatus` of `0` (Offline). In this setup, ASF is able to ignore even the specifically-crafted message without attempting to interpret it."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20: Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-5v34-4prm-9474",
"refsource": "CONFIRM",
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-5v34-4prm-9474"
},
{
"name": "https://github.com/JustArchiNET/ArchiSteamFarm/commit/4cd581ec041912cf199c5512fe6d1dcaec0594c0",
"refsource": "MISC",
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/commit/4cd581ec041912cf199c5512fe6d1dcaec0594c0"
},
{
"name": "https://steamcommunity.com/groups/archiasf/discussions/1/2935742047969570844/",
"refsource": "MISC",
"url": "https://steamcommunity.com/groups/archiasf/discussions/1/2935742047969570844/"
}
]
},
"source": {
"advisory": "GHSA-5v34-4prm-9474",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-32795",
"datePublished": "2021-07-26T19:25:11.000Z",
"dateReserved": "2021-05-12T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:33:55.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32794 (GCVE-0-2021-32794)
Vulnerability from cvelistv5 – Published: 2021-07-26 18:55 – Updated: 2024-08-03 23:33
VLAI?
Title
Accidental removal of IPCPassword (< 5.1.2.4)
Summary
ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code `POST /Api/ASF` ASF API endpoint responsible for updating global ASF config incorrectly removed `IPCPassword` from the resulting config when the caller did not specify it explicitly. Due to the above, it was possible for the user to accidentally remove `IPCPassword` security measure from his IPC interface when updating global ASF config, which exists as part of global config update functionality in ASF-ui. Removal of `IPCPassword` possesses a security risk, as unauthorized users may in result access the IPC interface after such modification. The issue is patched in ASF V5.1.2.4 and future versions. We recommend to manually verify that `IPCPassword` is specified after update, and if not, set it accordingly. In default settings, ASF is configured to allow IPC access from `localhost` only and should not affect majority of users.
Severity ?
6.8 (Medium)
CWE
- CWE-287 - Improper Authentication
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| JustArchiNET | ArchiSteamFarm |
Affected:
< 5.1.2.4
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:55.906Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-wxx4-66c2-vj2v"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/pull/2379"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://steamcommunity.com/groups/archiasf/discussions/6/3057365873428498659/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ArchiSteamFarm",
"vendor": "JustArchiNET",
"versions": [
{
"status": "affected",
"version": "\u003c 5.1.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code `POST /Api/ASF` ASF API endpoint responsible for updating global ASF config incorrectly removed `IPCPassword` from the resulting config when the caller did not specify it explicitly. Due to the above, it was possible for the user to accidentally remove `IPCPassword` security measure from his IPC interface when updating global ASF config, which exists as part of global config update functionality in ASF-ui. Removal of `IPCPassword` possesses a security risk, as unauthorized users may in result access the IPC interface after such modification. The issue is patched in ASF V5.1.2.4 and future versions. We recommend to manually verify that `IPCPassword` is specified after update, and if not, set it accordingly. In default settings, ASF is configured to allow IPC access from `localhost` only and should not affect majority of users."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-26T18:55:11.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-wxx4-66c2-vj2v"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/pull/2379"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://steamcommunity.com/groups/archiasf/discussions/6/3057365873428498659/"
}
],
"source": {
"advisory": "GHSA-wxx4-66c2-vj2v",
"discovery": "UNKNOWN"
},
"title": "Accidental removal of IPCPassword (\u003c 5.1.2.4)",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-32794",
"STATE": "PUBLIC",
"TITLE": "Accidental removal of IPCPassword (\u003c 5.1.2.4)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ArchiSteamFarm",
"version": {
"version_data": [
{
"version_value": "\u003c 5.1.2.4"
}
]
}
}
]
},
"vendor_name": "JustArchiNET"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code `POST /Api/ASF` ASF API endpoint responsible for updating global ASF config incorrectly removed `IPCPassword` from the resulting config when the caller did not specify it explicitly. Due to the above, it was possible for the user to accidentally remove `IPCPassword` security measure from his IPC interface when updating global ASF config, which exists as part of global config update functionality in ASF-ui. Removal of `IPCPassword` possesses a security risk, as unauthorized users may in result access the IPC interface after such modification. The issue is patched in ASF V5.1.2.4 and future versions. We recommend to manually verify that `IPCPassword` is specified after update, and if not, set it accordingly. In default settings, ASF is configured to allow IPC access from `localhost` only and should not affect majority of users."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-287: Improper Authentication"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-wxx4-66c2-vj2v",
"refsource": "CONFIRM",
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-wxx4-66c2-vj2v"
},
{
"name": "https://github.com/JustArchiNET/ArchiSteamFarm/pull/2379",
"refsource": "MISC",
"url": "https://github.com/JustArchiNET/ArchiSteamFarm/pull/2379"
},
{
"name": "https://steamcommunity.com/groups/archiasf/discussions/6/3057365873428498659/",
"refsource": "MISC",
"url": "https://steamcommunity.com/groups/archiasf/discussions/6/3057365873428498659/"
}
]
},
"source": {
"advisory": "GHSA-wxx4-66c2-vj2v",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-32794",
"datePublished": "2021-07-26T18:55:11.000Z",
"dateReserved": "2021-05-12T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:33:55.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}