Inadequate access verification when using proxy commands in ArchiSteamFarm
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.
Summary
ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn't adequately verify effective access of the user sending proxy (i.e. `[Bots]`) commands. In particular, a proxy-like command sent to bot `A` targeting bot `B` has incorrectly verified user's access against bot `A` - instead of bot `B`, to which the command was originally designated. This in result allowed access to resources beyond those configured, being a security threat affecting confidentiality of other bot instances. A successful attack exploiting this bug requires a significant access granted explicitly by original owner of the ASF process prior to that, as attacker has to control at least a single bot in the process to make use of this inadequate access verification loophole. The issue is patched in ASF V5.2.2.5, V5.2.3.2 and future versions. Users are advised to update as soon as possible.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| JustArchiNET | ArchiSteamFarm | 5.2.2.2 to before 5.2.2.5; 5.2.3.0 to before 5.2.3.2 | 5.2.2.5, 5.2.3.2 | Patch available | CNA |
- ArchiSteamFarm VendorJustArchiNET Affected 5.2.2.2 to before 5.2.2.5; 5.2.3.0 to before 5.2.3.2 Fixed in 5.2.2.5, 5.2.3.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:archisteamfarm_project:archisteamfarm:*:*:*:*:*:*:*:* | 5.2.2.2 to before 5.2.2.5; 5.2.3.0 to before 5.2.3.2 | Vulnerable | JustArchiNET |
- cpe:2.3:a:archisteamfarm_project:archisteamfarm:*:*:*:*:*:*:*:* Versions 5.2.2.2 to before 5.2.2.5; 5.2.3.0 to before 5.2.3.2 Vulnerable ·JustArchiNET
Remediation
- Fix · CNA ArchiSteamFarm (JustArchiNET) Fixed in 5.2.2.5, 5.2.3.2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23627
References
Patch 4
- https://github.com/JustArchiNET/ArchiSteamFarm/pull/2501
- https://github.com/JustArchiNET/ArchiSteamFarm/pull/2509
- https://github.com/JustArchiNET/ArchiSteamFarm/commit/7a29d9282bdc3280db2a379c24f73916d786f9b4
- https://github.com/JustArchiNET/ArchiSteamFarm/commit/f807bdb660e75dee5a34994f2ea70970ca6d0492
More JustArchiNET Archisteamfarm vulnerabilities
- TI-2021-12460 Accidental removal of IPCPassword (< 5.1.2.4) CVSS 3.1HIGH 7.5
- TI-2021-12461 Denial of Service via Steam chat in ArchiSteamFarm CVSS 3.1MEDIUM 6.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences