Description
GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
GDevelop GDevelop
Default version status: unaffected
0 to ≤ 5.6.284affected
References
- https://github.com/4ian/GDevelop/issues/9257 ↗
- https://github.com/4ian/GDevelop/commit/fbb01f40a640c35c6064f827065eda00e5608690 ↗
- https://github.com/4ian/GDevelop/blob/v5.6.284/newIDE/electron-app/app/LocalFileDownloader.js ↗
- https://github.com/4ian/GDevelop/blob/v5.6.284/newIDE/app/src/ProjectsStorage/LocalFileStorageProvider/LocalFileResourceMover.js ↗
- https://www.vulncheck.com/advisories/gdevelop-through-5.6.284-cookie-leak-via-localfiledownloader-resource-urls ↗