External risk intelligence

Cfx.re FXServer Improper Access Control Allows Data Modification and Reading

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2024-46310

The vulnerability exists in an API endpoint within FXServer, which is typically deployed to host multiplayer game servers accessible over the public internet. Because these services are designed to be reachable by clients connecting remotely, the exposed API surface is commonly accessible in standard deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security vulnerability in FXServer, a platform for hosting multiplayer game servers. The flaw allows unauthorized access to user data through an exposed API, potentially leading to unauthorized modifications or reads of sensitive information. The primary concern is to confirm if our environment utilizes this specific technology and is exposed to this risk.

Unauthenticated users can access and change game server data.
It affects widely accessible multiplayer game hosting platforms.
Confirm if FXServer is in use and identify potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could begin by interacting with a vulnerable FXServer over the network. This engagement targets an exposed API endpoint that lacks proper access controls. Successful interaction with this endpoint could allow an unauthenticated user to read and modify sensitive user data.

Network access to FXServer is required.
Attacker triggers vulnerability via exposed API.
Unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated users to access and alter user data stored within FXServer. When supported by the advisory's context, this could impact systems that host multiplayer game servers and store associated user information.

User data stored on the server.
Via an exposed API endpoint.
Unauthorized modification of user data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The FXServer's exposed API endpoint, accessible remotely, requires immediate attention from platform or infrastructure teams responsible for game server hosting. The first step is to identify all instances of FXServer, assess their reachability and criticality, and determine the accountable owner before planning remediation.

Platform or infrastructure teams own this issue.
Verify API endpoint reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cfx.re FXServer?

FXServer is the core technology used to host and manage custom multiplayer game servers. It provides the necessary infrastructure to run game logic and support player connectivity for community-driven gaming environments.

What does CVE-2024-46310 mean for data security?

This vulnerability is an instance of Improper Access Control (CWE-281). It means that a security check designed to verify who is allowed to interact with server data is missing or ineffective at a specific API endpoint. Because of this, the server fails to distinguish between an authorized administrator and an unauthenticated visitor, allowing outsiders to read or change stored user information.

How do attackers trigger this vulnerability?

An attacker triggers this bug by sending network requests directly to the vulnerable API endpoint in FXServer. No special login credentials or pre-existing server access is required to initiate the attack. However, the flaw cannot be triggered if the API endpoint is completely disconnected from the network or restricted by a firewall that prevents external communication.

Is my FXServer instance at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant if your FXServer is reachable over the public internet, which is common for multiplayer hosting. If your server is intended to be accessed by remote players, the API endpoint is likely exposed, increasing the likelihood that it could be targeted.

What steps should I take if I run FXServer?

Start by auditing your infrastructure to locate all active FXServer instances. Once identified, evaluate whether these servers are exposed to the public internet and confirm who is responsible for managing them. Prioritize these systems for review to understand their reachability and determine the necessary steps to restrict unauthorized access to the affected API.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.