Summary

.

Introduction

This vulnerability impacts:

• Mario Kart 8 Deluxe on the Switch
• Mario Kart 8 on the WiiU

The vulnerability was fixed for Mario Kart 8 Deluxe the 7 December, 2022 with the release of v2.2 (or v851968 for the internal version) The vulnerability was fixed for Mario Kart 8 the 3 August, 2023 with the release of v4.2 (or v851968 for the internal version)

NOTE: The issue was fixed by removing the "recommended" tournament section

When looking for competitions (tournaments), the game will fetch the recommended/favorites from the game server It uses an attributes filter to know what competition is "Recommended"

Using the NEX server call MatchmakeExtensionProtocol::CreateCompetition, you can create a competition

It takes a SimpleSearchObject (it has an attributes field, a list of unsigned 32-bit integers), passing the correct attributes would make your competition appear under the "Recommended" section (right next to Nintendo official competitions)

Attribute at index 12 - Official

Attribute at index 13 - Recommended

The server wasn't validating the attribute list

The game was fetching up to 20 official competitions, and only 4 already existed So a malicious user could use up to 16 rows, for example to show a message to all the players browsing the tournaments