{"id":"GHSA-hvm9-wc8j-mgrc","aliases":[],"status":"published","title":"TShock Security Escalation Exploit","description":"### Impact\nAn issue with the way OTAPI manages client connections results in stale UUIDs remaining on `RemoteClient` instances after a player disconnects.\n\nBecause of this, if the following conditions are met a player may assume the login state of a previously connected player:\n1. The server has UUID login enabled\n2. An authenticated player disconnects\n3. A subsequent player connects with a modified client that does not send the `ClientUUID#68` packet during connection\n4. The server assigns the same `RemoteClient` object that belonged to the originally authenticated player to the newly connected player\n\n\n### Patches\nTShock 5.2.1 hotfixes this issue. A more robust fix will be made to OTAPI itself.\n\n### Workarounds\nImplement a RemoteClient reset event handler in a plugin like so:\n```csharp\npublic override void Initialize()\n{\n        On.Terraria.RemoteClient.Reset += RemoteClient_Reset;\n}\n\nprivate static void RemoteClient_Reset(On.Terraria.RemoteClient.orig_Reset orig, RemoteClient client)\n{\n\tclient.ClientUUID = null;\n        orig(client);\n}\n```","severity":{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:H/SA:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-305","CWE-613","CWE-863"],"published":"2024-12-18T18:19:12Z","modified":"2024-12-18T18:46:35Z","fixes":[{"ecosystem":"NuGet","package":"TShock","fixed_in":["5.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"TShock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.21"},{"fixed":"5.2.1"}]}]},{"source":"osv","ecosystem":"NuGet","package":"TShock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.21"},{"fixed":"5.2.1"}]}],"versions":["5.0.0","5.0.0-beta","5.1.0","5.1.1","5.1.2","5.1.3","5.2.0"]}],"references":[{"url":"https://github.com/Pryaxis/TShock/security/advisories/GHSA-hvm9-wc8j-mgrc","tags":["web"]},{"url":"https://github.com/Pryaxis/TShock/commit/5075997264b48e27960e3446a948ecb0ea0f5a03","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hvm9-wc8j-mgrc"},{"url":"https://github.com/Pryaxis/TShock","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-hvm9-wc8j-mgrc","title":"TShock Security Escalation Exploit","description":"### Impact\nAn issue with the way OTAPI manages client connections results in stale UUIDs remaining on `RemoteClient` instances after a player disconnects.\n\nBecause of this, if the following conditions are met a player may assume the login state of a previously connected player:\n1. The server has UUID login enabled\n2. An authenticated player disconnects\n3. A subsequent player connects with a modified client that does not send the `ClientUUID#68` packet during connection\n4. The server assigns the same `RemoteClient` object that belonged to the originally authenticated player to the newly connected player\n\n\n### Patches\nTShock 5.2.1 hotfixes this issue. A more robust fix will be made to OTAPI itself.\n\n### Workarounds\nImplement a RemoteClient reset event handler in a plugin like so:\n```csharp\npublic override void Initialize()\n{\n        On.Terraria.RemoteClient.Reset += RemoteClient_Reset;\n}\n\nprivate static void RemoteClient_Reset(On.Terraria.RemoteClient.orig_Reset orig, RemoteClient client)\n{\n\tclient.ClientUUID = null;\n        orig(client);\n}\n```\n\n","status":"published","published":"2024-12-18T18:19:12Z","modified":"2024-12-18T18:19:13Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:H/SA:H","level":"high"}],"cwes":["CWE-305","CWE-613","CWE-863"],"updated_at":"2026-11-02T14:38:25.334027Z"}],"osv":[{"id":"GHSA-hvm9-wc8j-mgrc","title":"TShock Security Escalation Exploit","description":"### Impact\nAn issue with the way OTAPI manages client connections results in stale UUIDs remaining on `RemoteClient` instances after a player disconnects.\n\nBecause of this, if the following conditions are met a player may assume the login state of a previously connected player:\n1. The server has UUID login enabled\n2. An authenticated player disconnects\n3. A subsequent player connects with a modified client that does not send the `ClientUUID#68` packet during connection\n4. The server assigns the same `RemoteClient` object that belonged to the originally authenticated player to the newly connected player\n\n\n### Patches\nTShock 5.2.1 hotfixes this issue. A more robust fix will be made to OTAPI itself.\n\n### Workarounds\nImplement a RemoteClient reset event handler in a plugin like so:\n```csharp\npublic override void Initialize()\n{\n        On.Terraria.RemoteClient.Reset += RemoteClient_Reset;\n}\n\nprivate static void RemoteClient_Reset(On.Terraria.RemoteClient.orig_Reset orig, RemoteClient client)\n{\n\tclient.ClientUUID = null;\n        orig(client);\n}\n```\n\n","status":"published","published":"2024-12-18T18:19:12Z","modified":"2024-12-18T18:46:35.452868Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:H/SA:H","level":"high"}],"cwes":["CWE-305","CWE-613","CWE-863"],"updated_at":"2026-11-02T15:46:49.621585Z"}]}}