CVE-2023-32687 Insufficiently Protected ChatBot Credentials in tgstation-server
Users with list chat bots permission can read chat bot connection strings, exposing credentials in tgstation-server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-32687?
CVE-2023-32687 is a high-severity vulnerability in tgstation-server, published on 29 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround, remove the list chat bots permission from users that should not have the ability to view connection strings. Invalidate any credentials previously stored for safety.
Weakness: CWE-522
Which versions are affected by CVE-2023-32687?
It affects 1 product.
Products include Tgstation13 Tgstation-Server.
How do I fix CVE-2023-32687?
No fix has been published for CVE-2023-32687 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-32687 being exploited?
There is no known exploitation of CVE-2023-32687 in the wild and no public exploit code.
Other vulnerabilities in tgstation-server
- CVE-2018-17107 tgstation-server cached user logins in legacy server
- CVE-2025-21611 tgstation-server's role authorization incorrectly OR'd with user's enabled status
- CVE-2024-41799 tgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned users
- CVE-2020-16136 Path traversal in n/a
- CVE-2023-33198 Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API
Sources
Also known as GHSA-rv76-495p-g7cp.