sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2024-45407 Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client

Medium 6.5 Published Updated

Attackers can bypass authentication during pairing via MITM, gaining unauthorized access to the game streaming host by exploiting incorrect state management.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
A user has to click or open something
Fix
None listed

What is CVE-2024-45407?

CVE-2024-45407 is a medium-severity authentication bypass vulnerability in LizardByte Sunshine, published on 10 Sep 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantly allow access to an unintended client rather than failing authentication due to a PIN validation error. The pairing attempt fails due to the incorrect PIN, but the certificate from the forged pairing attempt is incorrectly persisted prior to the completion of the pairing request. This allows access to the certificate belonging to the attacker.

Weakness: CWE-300

Which versions are affected by CVE-2024-45407?

It affects 1 product.

Products include Lizardbyte Sunshine.

How do I fix CVE-2024-45407?

No fix has been published for CVE-2024-45407 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-45407 being exploited?

There is no known exploitation of CVE-2024-45407 in the wild and no public exploit code.

Sources

Also known as GHSA-jqph-8cp5-g874.

Is CVE-2024-45407 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free