Punkbuster Directory Traversal RCE (CVE-2020-24102/26037)

Vulnerability Overview Vulnerability Name: Directory Traversal Attack on Punkbuster Server CVE ID: CVE-2020-24102, CVE-2020-26037 Vulnerability Type: Directory Traversal Attack Vulnerability Description: The Punkbuster server contains a directory traversal vulnerability when handling screenshot requests sent by clients. Attackers can bypass server security checks by constructing malicious file names, allowing them to write arbitrary files to the server's file system. Affected Scope Affected Systems: Punkbuster Server Affected Games: Battlefield series games (e.g., Battlefield 4) Impact Severity: Attackers can execute code remotely, obtain sensitive information from the server, and potentially take control of the server. Remediation Measures Remediation Recommendations: - Strictly validate and filter file names sent by clients to ensure they do not contain path traversal characters (such as ). - Normalize file paths on the server side to prevent path traversal attacks. - Regularly update and patch the Punkbuster server to ensure the latest security patches are applied. POC Code Summary This vulnerability allows attackers to bypass Punkbuster server security checks by constructing malicious file names, achieving directory traversal attacks, which may subsequently lead to remote code execution. It is recommended to patch this vulnerability as soon as possible to ensure server security.

Goal Reached Thanks to every supporter — we hit 100%!

Punkbuster Directory Traversal RCE (CVE-2020-24102/26037)