Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in the Luanti (formerly Minetest) game-creation platform allows a malicious mod to break out of its secure environment. This could let an attacker run arbitrary code and access your entire file system. It's important to be aware of this if you use or develop for this platform, especially with older versions.
- Can lead to full system compromise.
- Affects server or client mods.
- Exploitable with LuaJIT.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this by crafting a malicious mod for the Luanti game platform. When this mod is loaded and executed, especially on the server-side or client-side in specific environments, it can break out of the game's sandbox. This allows the attacker to run arbitrary code on the user's machine with full filesystem access.
- Requires LuaJIT.
- Attacker provides malicious mod.
- User must load mod.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in Luanti (formerly Minetest) allows a malicious mod to execute arbitrary code on a user's device, providing full filesystem access. While the impact is severe, exploitation typically requires user interaction like installing untrusted mods or joining a compromised server. The specific dependency on LuaJIT might also limit its immediate broad applicability.
- Exploitation requires user action.
- Not an internet-facing service.
- Specific LuaJIT dependency.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching Luanti (Minetest) installations to version 5.15.2 or later to address the critical remote code execution vulnerability. If immediate patching is not feasible, apply the `getfenv = nil` workaround to `builtin/init.lua` to mitigate the risk, understanding this may break certain mods.
- Update to version 5.15.2 or later.
- Apply `getfenv = nil` workaround.
- Monitor for unexpected mod behavior.
