CVE-2022-23627: 
NixOS vulnerability analysis and mitigation

ArchiSteamFarm (ASF), a C# application designed for idling Steam cards from multiple accounts simultaneously, was found to contain a security vulnerability (CVE-2022-23627) introduced in version V5.2.2.2. The vulnerability was discovered and disclosed in February 2022, affecting versions between ≥5.2.2.2 and <5.2.2.5, as well as between ≥5.2.3.0 and <5.2.3.2 (GitHub Advisory).

The vulnerability stemmed from inadequate verification of effective access when users sent proxy commands (i.e., [Bots] commands). Specifically, when a proxy-like command was sent to bot A targeting bot B, the system incorrectly verified the user's access against bot A instead of the intended target bot B. This implementation flaw allowed potential access to resources beyond the configured permissions (GitHub Advisory). The vulnerability was assigned a CVSS v3.1 base score of 5.0 (Moderate), with metrics indicating Network attack vector, High attack complexity, High privileges required, and No user interaction needed (GitHub Advisory).

The vulnerability affected the confidentiality of other bot instances within the ASF process. While the impact was significant, it required the attacker to have pre-existing access granted explicitly by the original owner of the ASF process, as they needed to control at least one bot to exploit the inadequate access verification loophole. The majority of users running ASF in single-user scenarios were not directly affected, but those sharing access to their bots or running bots for other people were at risk (GitHub Advisory).

The vulnerability was patched in ASF versions V5.2.2.5 and V5.2.3.2. For users unable to upgrade, a recommended workaround was to ensure no other people were configured to access any declared bots, effectively removing the attack vector. Additionally, if users already had access to all bots (owning master permission), there was nothing further to exploit (GitHub Advisory).

The vulnerability was originally reported by TheRhanderson on the ASF Discord server. The issue was subsequently addressed through pull request #2509, which implemented the necessary fixes to the permission verification system (GitHub Advisory).