CVE-2018-17107: tgstation-server cached user logins in legacy server
Summary
CVE-2018-17107: tgstation-server cached user logins in legacy server. Affects TGServiceInterface versions >= 3.2.1.0, < 3.2.5.0. Fixed in 3.2.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The TGServiceInterface package is an open-source NuGet package that provides functionality for the tgstation-server. The tgstation-server is a legacy server used for running the Control Panel using Mono. It utilizes the WCF communication layer and includes hooks to accommodate Mono. The package is vulnerable to a caching issue in the legacy server, which allows users to login with any username/password combination if someone else is already logged in.
Vulnerability Detail
The vulnerability originates from a bug introduced in version 3.2.1.0 of the tgstation-server. The bug is related to the authentication process and the use of the 'authPolicy' parameter, which is poorly documented. This parameter is used to cache the previously returned policy, allowing users to bypass password authentication if someone else is already logged in. The bug was fixed in version 3.2.5.0, where a new empty list is returned when password authentication fails. The vulnerability has a CVSS score of 8.3, indicating a high severity.
How To Fix
Latest published version: 3.2.6 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the TGServiceInterface package used in the tgstation-server is vulnerable to a caching issue that allows unauthorized users to login with any username/password combination if someone else is already logged in. The vulnerability has been fixed in version 3.2.5.0 of the package. It is recommended to update to this version or higher to mitigate the risk of unauthorized access. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for TGServiceInterface →
FAQ
The vulnerability allows users to login with any username/password combination if someone else is already logged in. This can lead to unauthorized access to the server and potential misuse of privileges.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the packages.config file.
Yes, the vulnerability has been fixed in version 3.2.5.0 of the TGServiceInterface package. It is recommended to update to this version or higher to address the issue.
No specific workarounds have been mentioned for this vulnerability.
The CVSS score of this vulnerability is 8.3, indicating a high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for TGServiceInterface.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
