Unreal Engine 5.4 Server Arbitrary File Write (CVE-2024-11365) Analysis & POC

CVE-2024-11365: Arbitrary File Write Vulnerability in Unreal Engine 5.4 Server Vulnerability Overview Unreal Engine 5.4 contains an arbitrary file write vulnerability on the server side (CVE-2024-11365), which allows attackers to write arbitrary files on the server by crafting malicious requests. This vulnerability stems from improper handling of file paths in the function; insufficient path validation leads to path traversal attacks. Affected Scope Affected Versions: Unreal Engine 5.4 (as of January 2024) Affected Component: Server-side WebSocket request handling module Attack Conditions: Attackers must be able to send malicious HTTP requests to the target server (typically requires bypassing CORS or having legitimate connection permissions) Potential Impact: - Arbitrary files can be written to the server's file system - Critical configuration files, logs, or executables may be overwritten - Under specific conditions, this can be combined with other vulnerabilities to achieve remote code execution (RCE) Remediation Epic Games has fixed this vulnerability in subsequent versions. Users are advised to: 1. Upgrade to the Latest Stable Version: Immediately upgrade Unreal Engine to version 5.4.1 or higher (an official patch has been released). 2. Temporary Mitigation Measures: - Restrict server access to external requests (e.g., using firewalls, WAF) - Set strict permissions on server file directories (minimize write permissions) - Monitor for anomalous file write behavior (e.g., via audit logs or SIEM systems) POC Code (Full Excerpt) > ⚠️ Note: The above code is for demonstration purposes only to illustrate the vulnerability principle. Actual exploitation must be adjusted according to the target environment. Do not use for illegal purposes. Additional Notes This vulnerability exists due to a path handling defect in the file of Unreal Engine 5.4. The official Epic Games announcement states that this vulnerability only affects server instances with the WebSocket feature enabled. Developers are advised to implement path normalization and whitelist validation mechanisms in custom server implementations.

Goal Reached Thanks to every supporter — we hit 100%!

Unreal Engine 5.4 Server Arbitrary File Write (CVE-2024-11365) Analysis & POC