CVE-2024-31226: 
NixOS vulnerability analysis and mitigation

Sunshine, a self-hosted game stream host for Moonlight, contains a vulnerability (CVE-2024-31226) affecting versions 0.17.0 through 0.22.2 when running as a service on Windows. The vulnerability was discovered and disclosed in May 2024, impacting the service termination process on Windows systems (GitHub Advisory).

The vulnerability stems from an unquoted executable path in the service termination helper. The lpCommandLine parameter passed to CreateProcessAsUser() was initialized using an unquoted path returned from GetModuleFileName(). This implementation triggers Microsoft's documented executable search logic, which attempts to locate executables in a specific order, potentially leading to unintended execution paths (GitHub Advisory). The vulnerability has been assigned a CVSS v3.1 base score of 4.9 (Medium) with the vector string CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H (NVD).

If successfully exploited, the vulnerability could allow an attacker to execute arbitrary code through path interception when the Sunshine service is terminated. The impact is limited to scenarios where users have manually loosened Access Control Lists (ACLs) on the system drive (GitHub Advisory).

The vulnerability requires specific conditions to be exploitable: the attacker must place a malicious file named 'C:\Program.exe', 'C:\Program.bat', or 'C:\Program.cmd' on the user's computer, and the system's ACLs must have been manually loosened. The executable name may vary depending on the user's system locale, as it is based on the Program Files directory name (GitHub Advisory).

The vulnerability has been patched in version 0.23.0. For users unable to update immediately, several workarounds are available: implement application control tools like Windows Defender Application Control, AppLocker, or Software Restriction Policies; ensure proper permissions and directory access control to prevent file writes to the C: directory; and require all executables to be placed in write-protected directories (GitHub Advisory, GitHub PR).