CVE-2024-31226
Lizardbyte Sunshine 0.17.0 – 0.23.0
Raw vector
CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:HSummary
CVE-2024-31226 is a medium-severity Unquoted Search Path or Element (CWE-428) vulnerability in Lizardbyte Sunshine. Its CVSS base score is 4.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-29122
Vulnerability Data
Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named `C:\Program.exe`, `C:\Program.bat`, or `C:\Program.cmd`…
more
on the user's computer. This attack vector isn't exploitable unless the user has manually loosened ACLs on the system drive. If the user's system locale is not English, then the name of the executable will likely vary. Version 0.23.0 contains a patch for the issue. Some workarounds are available. One may identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate. Alternatively, ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory `C:`. Require that all executables be placed in write-protected directories.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover unquoted search paths through static analysis or dynamic test cases.
Documented development standards and tools can mandate proper quoting and escaping of path elements.
Engineering principles can require safe construction and quoting of search paths and command elements.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent path-handling flaws such as unquoted elements during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect unquoted search-path issues before deployment.
Enforcing controlled software installation can prevent unquoted search-path elements in executables and scripts.
Secure development lifecycle practices include input validation and path handling that reduce unquoted search-path weaknesses.
Secure system architecture and engineering principles require safe path construction and quoting conventions.
Secure coding standards directly mandate quoting search paths and avoiding unsafe path construction.
Change-management processes can enforce review of path-handling changes that might introduce unquoted elements.