CVE-2022-23627

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2022-23627

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23627.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-23627

Aliases

GHSA-88ch-366c-5m89

Published

2022-02-08T22:30:13Z

Modified

2025-12-04T10:16:07.486596Z

Severity

5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

Inadequate access verification when using proxy commands in ArchiSteamFarm

Details

ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn't adequately verify effective access of the user sending proxy (i.e. [Bots]) commands. In particular, a proxy-like command sent to bot A targeting bot B has incorrectly verified user's access against bot A - instead of bot B, to which the command was originally designated. This in result allowed access to resources beyond those configured, being a security threat affecting confidentiality of other bot instances. A successful attack exploiting this bug requires a significant access granted explicitly by original owner of the ASF process prior to that, as attacker has to control at least a single bot in the process to make use of this inadequate access verification loophole. The issue is patched in ASF V5.2.2.5, V5.2.3.2 and future versions. Users are advised to update as soon as possible.

Database specific

{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23627.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/justarchinet/archisteamfarm

Affected ranges

Type

GIT

Repo

https://github.com/justarchinet/archisteamfarm

Events

Introduced

e0a8f96ec4feca5e6e6cac701ea5eac25399e190

Fixed

29fae79aa03e8d916a387099dc6decd541386e81

Database specific

{
    "versions": [
        {
            "introduced": "5.2.2.2"
        },
        {
            "fixed": "5.2.2.5"
        }
    ]
}

Type

GIT

Repo

https://github.com/justarchinet/archisteamfarm

Events

Introduced

f28ae15cc97b2700a23c5580363601f28051f212

Fixed

f807bdb660e75dee5a34994f2ea70970ca6d0492

Database specific

{
    "versions": [
        {
            "introduced": "5.2.3.0"
        },
        {
            "fixed": "5.2.3.2"
        }
    ]
}

Affected versions

5.*

5.2.3.0

5.2.3.1