CVE-2021-33879 Supply chain in n/a
Attackers can execute arbitrary code via MITM attacks on insecure HTTP updates in Tencent GameLoop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-33879?
CVE-2021-33879 is a high-severity vulnerability in n/a, published on 6 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only integrity check would be a comparison of the downloaded file's MD5 checksum to the one contained within the XML document, the downloaded executable would then be executed on the victim's machine.
Weakness: CWE-494
Which versions are affected by CVE-2021-33879?
It affects 1 product.
Products include Tencent Gameloop.
How do I fix CVE-2021-33879?
No fix has been published for CVE-2021-33879 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-33879 being exploited?
There is no known exploitation of CVE-2021-33879 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-p52r-cj24-79f7.