Squirrel Engine Bug Could Let Attackers Hack Games and Cloud Services

guest · Oct 19, 2021

Squirrel Engine Bug Could Let Attackers Hack Games and Cloud Services
October 19, 2021
https://thehackernews.com/2021/10/squirrel-engine-bug-could-let-attackers.html

Researchers have disclosed an out-of-bounds read vulnerability in the Squirrel programming language that can be abused by attackers to break out of the sandbox restrictions and execute arbitrary code within a SquirrelVM, thus giving a malicious actor complete access to the underlying machine.

Tracked as CVE-2021-41556, the issue occurs when a game library referred to as Squirrel Engine is used to execute untrusted code and affects stable release branches 3.x and 2.x of Squirrel. The vulnerability was responsibly disclosed on August 10, 2021.
Click to expand...

Squirrel is an open-source, object-oriented programming language that's used for scripting video games and as well as in IoT devices and distributed transaction processing platforms such as Enduro/X.

"In a real-world scenario, an attacker could embed a malicious Squirrel script into a community map and distribute it via the trusted Steam Workshop," researchers Simon Scannell and Niklas Breitfeld said in a report shared with The Hacker News.
Click to expand...

SonarSource: Squirrel Sandbox Escape allows Code Execution in Games and Cloud Services

SquirrelLang is an interpreted, open-source programming language that is used by video games and cloud services for customization and plugin development. For example, the extremely popular game Counter-Strike: Global Offensive (CS:GO) attracts millions of players on a monthly basis and utilizes the Squirrel Engine to enable anyone to create custom game modes and maps.

In this blog post, we break down a vulnerability we discovered in the core of Squirrel which was developed in C. It enables an attacker to bypass the sandbox restrictions and execute arbitrary code within a SquirrelVM, giving the attacker full access to the underlying machine.
Click to expand...

Log in or Sign up

Squirrel Engine Bug Could Let Attackers Hack Games and Cloud Services

guest Guest

Log in or Sign up

Squirrel Engine Bug Could Let Attackers Hack Games and Cloud Services

guest Guest

Useful Searches