This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π **Root Cause**: **CWE-352** (Cross-Site Request Forgery). The flaw lies in the **Web UI** implementation, which fails to validate request origins or use anti-CSRF tokens.
Q3Who is affected? (Versions/Components)
π₯ **Affected**: Users running **LizardByte Sunshine**. Specifically, versions **prior to 2025.628.4510**. If you are on an older build, you are vulnerable.
Q4What can hackers do? (Privileges/Data)
π **Attacker Capabilities**: With user interaction, hackers can execute **arbitrary commands**. This leads to full **Confidentiality, Integrity, and Availability** compromise (CVSS High impact).
Q5Is exploitation threshold high? (Auth/Config)
βοΈ **Exploitation Threshold**: **Low**. Requires **Network** access, **Low** complexity, and **No Privileges** needed for the attacker.β¦
π¦ **Public Exploit**: **No** public PoC or wild exploitation code is currently listed in the data. However, the vulnerability type (CSRF) is well-understood and easily exploitable manually.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Check your Sunshine version number. If it is **< 2025.628.4510**, you are at risk. Look for Web UI endpoints that accept state-changing requests without CSRF tokens.
Q8Is it fixed officially? (Patch/Mitigation)
π‘οΈ **Official Fix**: **Yes**. The vendor (LizardByte) has issued a security advisory (GHSA-39hj-fxvw-758m) and a commit fix. **Update immediately** to version 2025.628.4510 or later.
Q9What if no patch? (Workaround)
π§ **No Patch Workaround**: If you cannot update, **disable the Web UI** if not strictly needed. Implement **Network Segmentation** to restrict access to the Sunshine Web UI. Use **Strict CORS** policies if possible.
Q10Is it urgent? (Priority Suggestion)
β‘ **Urgency**: **HIGH**. CVSS Score indicates **Critical** impact (C:H, I:H, A:H). Since it allows arbitrary command execution via a simple UI interaction, patch **immediately** upon upgrading.