CVE-2024-41799

Summary: CVE-2024-41799 affects tgstation-server (BYOND server management). Prior to version 6.8.0, low-permission users with the “Set .dme Path” privilege could cause malicious .dme files on the host to be compiled and executed, potentially leading to remote code execution via BYOND’s shell() pr...

CVE-2024-41799 tgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned users

tgstation-server is a production scale tool for BYOND server management. Prior to 6.8.0, low permission users using the "Set .dme Path" privilege could potentially set malicious .dme files existing on the host machine to be compiled and executed. These .dme files could be uploaded via...

tgstation-server 安全漏洞

tgstation-server is a tgstation open source toolset for managing production BYOND servers. A security vulnerability exists in tgstation-server version 4.0.0 through versions prior to 6.8.0. An attacker exploiting this vulnerability could remotely execute code...

PT-2024-29565 · Byond +1 · Byond +1

Name of the Vulnerable Software and Affected Versions: tgstation-server versions prior to 6.8.0 Description: The issue allows low permission users with the "Set .dme Path" privilege to potentially set malicious .dme files existing on the host machine to be compiled and executed. These .dme files...

tgstation-server cached user logins in legacy server

Please note this advisory is for a historical preexisting issue in the legacy server from 2018. It has long since been triaged. It is being moved here for visibility. The text below is copied from the original issue 690 You can login to the server with any username/password combination if someone...

CVE-2023-34243 Windows user name disclosure in TGstation

TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server TGS, an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct respon...

tgstation-server 信息泄露漏洞

tgstation-server is a toolset for managing production BYOND servers. An information disclosure vulnerability exists in TGstation versions prior to 5.12.5, which originates from a username that can be discovered by forcing a login to the endpoint with an invalid password...

CVE-2023-33198

tgstation-server is a production scale tool for BYOND server management. The DreamMaker API DMAPI chat channel cache can possibly be poisoned by a tgstation-server TGS restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the...

Command injection

tgstation-server is a production scale tool for BYOND server management. The DreamMaker API DMAPI chat channel cache can possibly be poisoned by a tgstation-server TGS restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the...

CVE-2023-33198 Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API

tgstation-server is a production scale tool for BYOND server management. The DreamMaker API DMAPI chat channel cache can possibly be poisoned by a tgstation-server TGS restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the...

CVE-2023-33198 Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API

tgstation-server is a production scale tool for BYOND server management. The DreamMaker API DMAPI chat channel cache can possibly be poisoned by a tgstation-server TGS restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the...

CVE-2023-33198 Incorrectly Specified Chat Message Destinations in tgstation-server and DreamMaker API

tgstation-server is a production scale tool for BYOND server management. The DreamMaker API DMAPI chat channel cache can possibly be poisoned by a tgstation-server TGS restart and reattach. This can result in sending chat messages to one of any of the configured IRC or Discord channels for the...

CVE-2023-33198

tgstation-server (DMAPI chat channel cache) can be poisoned on TGS detach/reattach, causing chat messages to be sent to configured IRC/Discord channels until channels are updated or DreamDaemon is restarted. Affected: tgstation-server and DMAPI cache handling. Remediation: upgrade to tgstation-se...

tgstation-server 安全漏洞

tgstation-server is a toolset for managing production BYOND servers. A security vulnerability exists in tgstation-server that stems from problematic TGS restarts and reconnections...

PT-2023-24215 · Discord · Discord

Name of the Vulnerable Software and Affected Versions: tgstation-server affected versions not specified Description: The issue concerns the DreamMaker API DMAPI chat channel cache in tgstation-server, which can be poisoned upon a restart and reattach of the server. This can lead to chat messages...

CVE-2023-32687

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...

Code injection

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...

CVE-2023-32687

CVE-2023-32687 affects tgstation-server versions 4.7.0 through 5.12.1, where users with the public list chat bots permission can read chat bot connection strings without the required permission. The issue is patched in version 5.12.1. Remediation: update to 5.12.1; as a workaround, remove the lis...

CVE-2023-32687 Insufficiently Protected ChatBot Credentials in tgstation-server

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...

CVE-2023-32687 Insufficiently Protected ChatBot Credentials in tgstation-server

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...