CVE-2023-33198 Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API

Medium 6.1 Published 30 May 2023 Updated 10 Jan 2025

Attackers can poison chat caches to redirect messages to unintended IRC or Discord channels, exposing private communications to unauthorized recipients.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-33198?

CVE-2023-33198 is a medium-severity vulnerability in tgstation-server, published on 30 May 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-server (TGS) restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the instance on enabled chat bots. This lasts until the instance's chat channels are updated in TGS or DreamDaemon is restarted. TGS chat commands are unaffected, custom or otherwise.

Weakness: CWE-941

Which versions are affected by CVE-2023-33198?

It affects 1 product.

Products include Tgstation13 Tgstation-Server.

How do I fix CVE-2023-33198?

No fix has been published for CVE-2023-33198 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-33198 being exploited?

There is no known exploitation of CVE-2023-33198 in the wild and no public exploit code.

Sources

Also known as GHSA-p2xj-w57r-6f5m.