Security flaws discovered in the PlayStation Now (PS Now) Windows gaming app allowed attackers to execute arbitrary code on Windows devices running vulnerable versions of the app.
PlayStation Now reached 2.2 million subscribers at the end of April 2020.
The vulnerabilities discovered by bug hunter Parsia Hakimian affected PS Now version 11.0.2 (and later versions) on computers running Windows 7 SP1 or later.
Hakimian reported the PS Now bug on May 13, 2020, through PlayStation's official bug bounty program on HackerOne. PlayStation addressed the bug and marked the bug report as "Resolved" a month later, on June 25, 2020.
He was awarded a $15,000 bounty for his report, even though his submission was out of scope – that is, it affected a Windows application and not one of the targeted assets included in the bug bounty (PlayStation 4 and PlayStation 5 systems, operating systems, accessories, or the PlayStation Network.)
Vulnerable Electron app exposes users to RCE attacks
Hakimian found that the critical security issues allowed unauthorized attackers to launch remote code execution ( RCE ) attacks by abusing a code injection vulnerability .
Attackers can execute malicious code on a PS NOW user's computer via a local WebSocket.
This is possible because the websocket server “started” on the target does not execute any Origin headers and does not request origin checks.
To successfully exploit the RCE flaw, attackers must convince the PS NOW user whose device they want to compromise to open a specially crafted website using a malicious link provided via Discord, forums, phishing email messages, etc.
Once opened in any web browser on their computer, malicious scripts will connect to the local WebSocket server and ask the AGL application to load malicious Node code from another website and execute it on the target device .
