The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RequestSendMessageToPlayers request. For example, ability to send a push message to hundreds of thousands of machines is only restricted on the client side, and can thus be bypassed with a modified client.
References
Link | Resource |
---|---|
https://fromsoftware.jp | Product |
https://github.com/tremwil/ds3-nrssr-rce | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2022-03-20T00:03:47
Updated: 2022-03-20T00:03:47
Reserved: 2022-01-29T00:00:00
Link: CVE-2022-24125
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-03-20T01:15:08.667
Modified: 2023-08-08T14:22:24.967
Link: CVE-2022-24125
JSON object: View
Redhat Information
No data.
CWE