Security: master.openra.net does not santize input and allows remote code execution

[martinalderson]

Please let me know the best way to disclose this issue.

[martinalderson]

Would recommending disabling master.openra.net until patched. Able to deliver malware to win/mac/linux to any client that connects to master.openra.net

[chrisforbes]

@martinalderson we don't have an established mechanism for reporting security issues yet; please disclose these privately to me via email; chrisf@ijw.co.nz.

[mkondel]

Does the malware persist between client restarts?

[chrisforbes]

@martinalderson I've not heard from you...

[pchote]

The client queries the master server from only two places (querying server list and game news), and in both it directly parses the returned result as text. Only the news query saves the data to disk, and this is not executed.

I won't speculate further without knowing the details of the report, but I don't see any risk for executing code on the client-side, so removing from the milestone.

[Mailaender]

Closing here as these exploits should not be publicized until fixed. https://github.com/OpenRA/OpenRAMasterServer also has it's own tracker.