Skip to content

A2S_INFO cache bypasses challenge validation, reintroducing reflection/amplification vulnerability #102

Description

@BlackOverride

When info_cache_enabled is on, serversecure answers A2S_INFO from its cache in the recvfrom detour, before the packet reaches the engine. Because the cached path never validates an A2S challenge, it bypasses the engine's STEAM_GAMESERVER_A2S_INFO_REQUIRE_CHALLENGE handshake (the 2020 mitigation for UDP reflection/amplification).

For an operator who has enabled that engine setting, the result is that the protection silently does nothing for A2S_INFO: a spoofed-source request is answered from cache without completing the challenge handshake, so the server can still be used as a reflection/amplification target.

The length check (25/1200) doesn't mitigate this -> a spoofed packet can be padded to an accepted length.

Suggested fix -
when serving A2S_INFO from cache, honor the challenge. On a challenge-less request, reply with S2C_CHALLENGE and only serve the cached info once the client returns a valid challenge, mirroring what the engine does.
This preserves the cache's benefit (the challenge is a tiny extra round-trip, not a forward to the engine) while closing the reflection vector.

  • Tested on latest build

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions