CVE-2019-15943

vendor:

Counter-Strike Global Offensive

by:

bi7s

8.8

CVSS

HIGH

Memory Corruption

119

CWE

Product Name: Counter-Strike Global Offensive

Affected Version From: Counter-Strike Global Offensive (vphysics.dll) before 1.37.1.1

Affected Version To: Counter-Strike Global Offensive (vphysics.dll) 1.37.1.1

Patch Exists: YES

Related CWE: CVE-2019-15943

CPE: 2.3:a:valve:counter-strike_global_offensive

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows

2019

Counter-Strike Global Offensive (vphysics.dll) before 1.37.1.1 is vulnerable to a memory corruption vulnerability which can be exploited by creating a gaming server and inviting a victim to this server. An attacker can craft a malicious map using memory corruption and modify the class name value in the PoC for triggering this vulnerability. The offset for modifying the PoC is 0x115703. After copying the malicious map to the game directory, the attacker can start the game with the malicious map and exploit the vulnerability to achieve code execution or denial of service.

Mitigation:

Users should update their Counter-Strike Global Offensive (vphysics.dll) to version 1.37.1.1 or later to mitigate this vulnerability.

Source

Exploit-DB raw data:

# CVE-2019-15943

Counter-Strike Global Offensive (vphysics.dll) before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map using memory corruption. 

### Description:

We are need modifying class name value in our PoC for triggering this vulnerability, offset for modifying in our PoC is `0x115703`. For example add char `"="` using this offset. PoC is "mc.bsp"

![](https://github.com/bi7s/CVE/blob/master/CVE-2019-15943/img/offset.png)

For modeling situation for attack we are need next:
First step is copy mc.bsp to `C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo\maps`;

Second step is start game with our map (mc.bsp), for this we are need turn on game console and insert in console: `map mc`.

![](https://github.com/bi7s/CVE/blob/master/CVE-2019-15943/img/1.png)

After this steps we can see next:

![](https://github.com/bi7s/CVE/blob/master/CVE-2019-15943/img/windbg.png)

I was use msec.dll (!exploitable) is a Windows debugging extension (Windbg) that provides automated crash analysis and security risk assessment [Download msec.dll](https://archive.codeplex.com/?p=msecdbg)
As you can see msec.dll checked this crash and decide that is EXPLOITABLE crash, because SEH chain is corrupted. It is means that attacker can use this vulnerability for remote code execution.

EDB Note: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47454.bsp