[Fix] Minor item shop security issue

[Mi4uric3]

Hi,

while looking through the servers source code I received in 2013 I found a minor security issue regarding the item shop. An attacker is able to temporarily delete items bought in the item shop from the game, so the buyer is unable to receive it. All deleted items are restored after the server restarts though, as they are only removed from the databases cache, not from the database itself. Also the attacker can only remove the item from the cache if the user didn't login after buying it (player.item_award.taken_time != NULL).

PoC application which attacks my local test server:

To fix it you need to delete the following lines:

Server/common/tables.h:

HEADER_GD_DELETE_AWARDID	= 138,	// delete gift notify icon

Server/common/tables.h:

// 선물 알림 기능 삭제용 패킷 정보
typedef struct tDeleteAwardID
{
	DWORD dwID;
} TPacketDeleteAwardID;

Server/db/src/ClientManager.cpp:

//delete gift notify icon

case HEADER_GD_DELETE_AWARDID:
	DeleteAwardId((TPacketDeleteAwardID*) data);
	break;

Server/db/src/ClientManager.cpp:

// delete gift notify icon
void CClientManager::DeleteAwardId(TPacketDeleteAwardID *data)
{
	//sys_log(0,"data from game server arrived %d",data->dwID);
	std::map<DWORD, TItemAward *>::iterator it;
	it = ItemAwardManager::Instance().GetMapAward().find(data->dwID);
	if ( it != ItemAwardManager::Instance().GetMapAward().end() )
	{
		std::set<TItemAward *> & kSet = ItemAwardManager::Instance().GetMapkSetAwardByLogin()[it->second->szLogin];
		if(kSet.erase(it->second))
			sys_log(0,"erase ItemAward id: %d from cache", data->dwID);
		ItemAwardManager::Instance().GetMapAward().erase(data->dwID);
	}
	else
	{
		sys_log(0,"DELETE_AWARDID : could not find the id: %d", data->dwID);
	}
}

Server/db/src/ClientManager.h:

//delete gift notify icon
void DeleteAwardId(TPacketDeleteAwardID* data);

Server/game/src/input.cpp:

//gift notify delete command
else if (!stBuf.compare(0,15,"DELETE_AWARDID "))
{
	char szTmp[64];
	std::string msg = stBuf.substr(15,26);	// item_award의 id범위?

	TPacketDeleteAwardID p;
	p.dwID = (DWORD)(atoi(msg.c_str()));
	snprintf(szTmp,sizeof(szTmp),"Sent to DB cache to delete ItemAward, id: %d",p.dwID);
	//sys_log(0,"%d",p.dwID);
	// strlcpy(p.login, msg.c_str(), sizeof(p.login));
	db_clientdesc->DBPacket(HEADER_GD_DELETE_AWARDID, 0, &p, sizeof(p));
	stResult += szTmp;
}

[lollo_9_1]

Well, even though DELETE_AWARDID is exploitable by everyone, some other options have a similar troublesome issue: they don't delete rows somewhere, but generate a .txt any time they are called; if you flood such a process, you can freeze the machine quite easily.

The easiest way to solve such an issue would be checking if the admin page is empty, and if your ip is also in the allowed list soon after if (bHeader == HEADER_CG_TEXT).