FXServer < v9601 - Information Exposure

mediumseverity

2.6%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

Incorrect Access Control in FXServer version's v9601 and prior, for CFX.re FiveM, allows unauthenticated users to modify and read userdata via exposed api endpoint.

Impact

Unauthenticated users can access and modify sensitive userdata including player identifiers and connection information.

Fix

Update FXServer to a version later than v9601 that patches the access control vulnerability.

How to confirm it

Send: GET /players.json
Positive when: contains_all(body,"endpoint", "id", "identifiers", "name", "ping") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-46310 -u <target>

The full check

id: CVE-2024-46310

info:
  name: FXServer < v9601 - Information Exposure
  author: s4e-io
  severity: medium
  description: |
    Incorrect Access Control in FXServer version's v9601 and prior, for CFX.re FiveM, allows unauthenticated users to modify and read userdata via exposed api endpoint.
  impact: |
    Unauthenticated users can access and modify sensitive userdata including player identifiers and connection information.
  remediation: |
    Update FXServer to a version later than v9601 that patches the access control vulnerability.
  reference:
    - https://github.com/UwUtisum/CVE-2024-46310
    - https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-46310
    - https://vulners.com/githubexploit/D31ED8EC-1E21-54F9-AD42-778DAFBC8B4E
  classification:
    epss-score: 0.02593
    epss-percentile: 0.85441
  metadata:
    verified: true
    max-request: 1
    vendor: fxserver
    product: fxserver
  tags: cve,cve2024,fxserver,info-leak,vuln

http:
  - raw:
      - |
        GET /players.json HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"endpoint", "id", "identifiers", "name", "ping")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from