Summary
Sunshine improperly authorizes client certificates by accepting any certificate that chains to a stored paired-client certificate instead of requiring the exact enabled paired identity. A previously paired client that still holds its private key may bypass the Disable control, while equivalent PEM encodings can cause inconsistent identity handling.
Sunshine improperly authorizes client certificates by accepting any certificate that chains to a stored paired-client certificate instead of requiring the exact enabled paired identity. A previously paired client that still holds its private key may bypass the Disable control, while equivalent PEM encodings can cause inconsistent identity handling.
Affected context
The issue affects Sunshine deployments within the affected release range when client-certificate pairing is used for access control. It becomes risky when a previously paired client retains its private key and the operator attempts to disable that client, because certificate-chain acceptance may continue to recognize an alternate certificate as trusted.
The issue affects Sunshine deployments within the affected release range when client-certificate pairing is used for access control. It becomes risky when a previously paired client retains its private key and the operator attempts to disable that client, because certificate-chain acceptance may continue to recognize an alternate certificate as trusted.
Exploit preconditions
- Attack surface: Sunshine client-certificate authentication and paired-client authorization
- Required access: Control of the private key belonging to a previously paired client
- Trigger point: Certificate validation and enabled-client authorization
- Why exploitation is possible: Authorization relies on certificate chaining and non-canonical certificate comparisons rather than binding access to the exact enabled paired identity
- Attack surface: Sunshine client-certificate authentication and paired-client authorization
- Required access: Control of the private key belonging to a previously paired client
- Trigger point: Certificate validation and enabled-client authorization
- Why exploitation is possible: Authorization relies on certificate chaining and non-canonical certificate comparisons rather than binding access to the exact enabled paired identity
Why this happens
The vulnerability is caused by an authorization design that treats membership in a certificate chain as sufficient proof of the exact client identity authorized by the operator. The implementation also compares certificate representations without consistently canonicalizing equivalent PEM encodings, which can produce divergent identity decisions. This maps to CWE-863: Incorrect Authorization, because a client can remain effectively authorized after its specific paired identity has been disabled.
The vulnerability is caused by an authorization design that treats membership in a certificate chain as sufficient proof of the exact client identity authorized by the operator. The implementation also compares certificate representations without consistently canonicalizing equivalent PEM encodings, which can produce divergent identity decisions. This maps to CWE-863: Incorrect Authorization, because a client can remain effectively authorized after its specific paired identity has been disabled.
Potential impact
- A previously paired client may bypass an administrative Disable control
- An attacker holding the paired client's private key could retain unauthorized access
- Client identity records may be interpreted inconsistently across certificate representations
- Access to streamed games or associated Sunshine functionality could continue after revocation was expected
- A previously paired client may bypass an administrative Disable control
- An attacker holding the paired client's private key could retain unauthorized access
- Client identity records may be interpreted inconsistently across certificate representations
- Access to streamed games or associated Sunshine functionality could continue after revocation was expected
General mitigation guidance
Mitigation generally focuses on binding authorization to the exact paired identity and making certificate handling deterministic.
Common defensive patterns include:
- Compare canonical certificate identities or cryptographic fingerprints rather than raw PEM text
- Require an exact match against the currently enabled paired certificate
- Treat disabling or removing a paired client as an explicit trust-revocation operation
- Avoid accepting alternate certificates solely because they chain to a stored certificate
- Protect paired private keys and limit access to pairing data
- Apply least privilege to the Sunshine service and its surrounding host environment
Mitigation generally focuses on binding authorization to the exact paired identity and making certificate handling deterministic.
Common defensive patterns include:
- Compare canonical certificate identities or cryptographic fingerprints rather than raw PEM text
- Require an exact match against the currently enabled paired certificate
- Treat disabling or removing a paired client as an explicit trust-revocation operation
- Avoid accepting alternate certificates solely because they chain to a stored certificate
- Protect paired private keys and limit access to pairing data
- Apply least privilege to the Sunshine service and its surrounding host environment
How teams detect issues like this
Organizations can assess this class of issue through:
- Static analysis and code review of certificate-chain authorization logic
- Tests verifying that disabled identities cannot authenticate with alternate certificates
- Tests using equivalent PEM encodings to confirm consistent identity resolution
- Review of whether authorization uses exact identity binding, canonical fingerprints, and explicit revocation state
- Policy checks requiring certificate validation and authorization decisions to be separate and auditable
Automated security testing can help identify mismatches between certificate validation results and configured client permissions.
Organizations can assess this class of issue through:
- Static analysis and code review of certificate-chain authorization logic
- Tests verifying that disabled identities cannot authenticate with alternate certificates
- Tests using equivalent PEM encodings to confirm consistent identity resolution
- Review of whether authorization uses exact identity binding, canonical fingerprints, and explicit revocation state
- Policy checks requiring certificate validation and authorization decisions to be separate and auditable
Automated security testing can help identify mismatches between certificate validation results and configured client permissions.
