Comprehensive Technical Analysis of CVE-2023-37262

CVE ID: CVE-2023-37262 CVSS Score: 9.6 (Critical) Vulnerability Type: Information Disclosure / Privilege Escalation via Cloud Metadata Service Exposure

---

1. Vulnerability Assessment and Severity Evaluation

Overview

CVE-2023-37262 is a critical vulnerability in CC: Tweaked, a Minecraft mod that introduces programmable computers and turtles. The flaw arises from insufficient restrictions on HTTP requests made by in-game computers, allowing players to access cloud provider metadata services (e.g., AWS Instance Metadata Service, GCP Metadata Server, Azure Instance Metadata Service).

Severity Justification (CVSS 9.6)

The CVSS v3.1 score of 9.6 (Critical) is derived from the following metrics:

• Attack Vector (AV:N) – Exploitable remotely over the network.
• Attack Complexity (AC:L) – Low complexity; no special conditions required.
• Privileges Required (PR:N) – No privileges needed; any in-game player can exploit.
• User Interaction (UI:N) – No user interaction required.
• Scope (S:C) – Changes scope; impacts the underlying cloud infrastructure.
• Confidentiality (C:H) – High impact; sensitive cloud credentials may be exposed.
• Integrity (I:H) – High impact; potential for unauthorized actions on cloud resources.
• Availability (A:N) – No direct impact on availability.

The high severity stems from the potential for lateral movement into cloud environments, enabling attackers to escalate privileges, exfiltrate credentials, or compromise the hosting infrastructure.

---

2. Potential Attack Vectors and Exploitation Methods

Exploitation Mechanism

1. In-Game Computer Abuse

   • CC: Tweaked allows players to program in-game computers using Lua scripts.
   • These computers can make HTTP requests to external endpoints.
   • By default, the mod does not block access to cloud metadata services (e.g., 169.254.169.254 for AWS, metadata.google.internal for GCP, 169.254.169.254 for Azure).

2. Metadata Service Enumeration

   • An attacker-controlled in-game computer can query:
     • AWS IMDSv1/v2: http://169.254.169.254/latest/meta-data/
     • GCP Metadata Server: http://metadata.google.internal/computeMetadata/v1/
     • Azure IMDS: http://169.254.169.254/metadata/instance?api-version=2021-02-01
   • These endpoints expose temporary credentials, instance details, IAM roles, and other sensitive data.

3. Credential Harvesting & Privilege Escalation

   • If the Minecraft server is running on a cloud VM with an over-permissive IAM role, an attacker could:
     • Extract AWS/GCP/Azure credentials (e.g., AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY).
     • Use these credentials to pivot into the cloud environment, escalate privileges, or exfiltrate data.
     • Launch additional cloud resources (e.g., EC2 instances, Lambda functions) for further attacks.

Proof-of-Concept (PoC) Exploit

A simple Lua script running on an in-game computer could fetch AWS credentials:

local http = require("http")
local response = http.get("http://169.254.169.254/latest/meta-data/iam/security-credentials/")
if response then
    print(response.readAll())
end

If successful, this would return the IAM role name, which could then be used to fetch temporary credentials:

local creds = http.get("http://169.254.169.254/latest/meta-data/iam/security-credentials/<ROLE_NAME>")
if creds then
    print(creds.readAll()) -- Returns AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN
end

---

3. Affected Systems and Software Versions

Vulnerable Versions

• CC: Tweaked versions prior to:
  • 1.20.1-1.106.0
  • 1.19.4-1.106.0
  • 1.19.2-1.101.3
  • 1.18.2-1.101.3
  • 1.16.5-1.101.3

Affected Environments

• Minecraft servers running CC: Tweaked on cloud-hosted VMs (AWS, GCP, Azure).
• Self-hosted servers are not affected unless they explicitly allow outbound access to metadata services.

Not Affected

• Servers running patched versions of CC: Tweaked.
• Servers not hosted on cloud providers (e.g., local or on-premises deployments).

---

4. Recommended Mitigation Strategies

Immediate Actions

1. Upgrade CC: Tweaked

   • Apply the latest patched versions:
     • 1.20.1-1.106.0 or later
     • 1.19.4-1.106.0 or later
     • 1.19.2-1.101.3 or later
     • 1.18.2-1.101.3 or later
     • 1.16.5-1.101.3 or later

2. Block Metadata Service Access at the Network Level

   • AWS: Use IMDSv2 with hop limits or security group rules to block 169.254.169.254.
   • GCP: Apply VPC Service Controls to restrict metadata access.
   • Azure: Use Network Security Groups (NSGs) to block 169.254.169.254.

3. Restrict IAM Permissions

   • Ensure the Minecraft server’s IAM role follows the principle of least privilege.
   • Avoid assigning wildcard permissions (e.g., *:*).

4. Monitor for Suspicious Activity

   • CloudTrail (AWS), Audit Logs (GCP), Azure Monitor should track:
     • Unusual API calls from the Minecraft server’s IP.
     • Attempts to access metadata services.

Long-Term Recommendations

• Implement Network Segmentation
  • Isolate the Minecraft server in a dedicated VPC/subnet with strict egress filtering.
• Use Private Endpoints for Cloud Services
  • Avoid exposing metadata services to untrusted workloads.
• Regularly Audit Mod Configurations
  • Ensure no other mods introduce similar HTTP request vulnerabilities.
• Educate Server Administrators
  • Raise awareness about cloud metadata risks in gaming/modded environments.

---

5. Impact on the Cybersecurity Landscape

Broader Implications

1. Gaming as an Attack Surface

   • This vulnerability highlights how modded gaming environments can serve as entry points into cloud infrastructure.
   • Similar risks exist in other sandboxed scripting environments (e.g., Roblox, Garry’s Mod, Factorio mods).

2. Cloud Metadata Service Abuse

   • Metadata services remain a high-value target for attackers.
   • This CVE reinforces the need for default-deny policies on metadata access.

3. Supply Chain Risks in Modding Communities

   • Third-party mods can introduce unintended security flaws.
   • Dependency scanning and mod auditing should be part of server hardening.

4. Regulatory and Compliance Concerns

   • If exploited, this could lead to data breaches under GDPR, CCPA, or HIPAA.
   • Cloud providers may enforce stricter metadata protections in response.

---

6. Technical Details for Security Professionals

Root Cause Analysis

• Code Vulnerability Location:

  • dan200/computercraft/core/apis/http/options/AddressPredicate.java (Lines 116-126)
  • The mod did not blacklist cloud metadata service IPs/hostnames by default.

• Patch Analysis:

  • Commit: 4bbde8c50c00bc572578ab2cff609b3443d10ddf
  • Fix: Added hardcoded blacklist for:
    • 169.254.169.254 (AWS/Azure)
    • metadata.google.internal (GCP)
    • fd00:ec2::254 (AWS IPv6)

Exploitation Requirements

Requirement	Details
Access to In-Game Computer	Any player with access to a CC: Tweaked computer can exploit.
Outbound HTTP Access	The server must allow outbound HTTP requests (default in most setups).
Cloud-Hosted Server	Only affects servers running on AWS, GCP, or Azure.
Over-Permissive IAM Role	The cloud VM must have an IAM role with excessive permissions.

Detection & Forensics

• Cloud Provider Logs:

  • AWS: Check CloudTrail for GetInstanceMetadata or AssumeRole calls from the Minecraft server’s IP.
  • GCP: Review Audit Logs for compute.instances.get or iam.serviceAccounts.getAccessToken.
  • Azure: Monitor Azure Monitor for Microsoft.Compute/virtualMachines/runCommand or Microsoft.Authorization/roleAssignments.

• Network Traffic Analysis:

  • Look for HTTP requests to 169.254.169.254 or metadata.google.internal.
  • Check for unusual outbound connections from the Minecraft server.

• Lua Script Analysis:

  • Review saved Lua scripts on in-game computers for metadata service queries.

Advanced Mitigation Techniques

• eBPF-Based Network Filtering
  • Use eBPF/XDP to drop packets destined for metadata services at the kernel level.
• Containerization with Strict Network Policies
  • Run the Minecraft server in a Kubernetes pod with NetworkPolicy blocking metadata access.
• Runtime Application Self-Protection (RASP)
  • Deploy RASP solutions to monitor and block suspicious HTTP requests from in-game computers.

---

Conclusion

CVE-2023-37262 is a critical vulnerability that underscores the intersection of gaming and cloud security. While the fix is straightforward (upgrading CC: Tweaked), the potential impact—cloud credential theft and privilege escalation—makes this a high-priority patch for affected environments.

Security teams should:

1. Immediately upgrade CC: Tweaked to a patched version.
2. Harden cloud metadata access at the network and IAM levels.
3. Monitor for exploitation attempts via cloud provider logs.
4. Educate server administrators on the risks of modded gaming environments.

This vulnerability serves as a reminder that even seemingly low-risk applications (like Minecraft mods) can introduce significant security risks when integrated with cloud infrastructure.