I recently found two zero-day vulnerabilities in Neverness to Everness that can be chained for full account takeover.
NTE transmits authentication data in plaintext, which can be intercepted and modified by an attacker on the same network as the victim. Additionally, this data lacks replay protection, meaning captured authentication data can be reused indefinitely.
By chaining these together, an attacker can capture another player's authentication data and use it to log in and play NTE as a compromised player.
These vulnerabilities were responsibly disclosed to Perfect World / Hotta Studio. However, both remain unpatched after over 170 days of disclosure, and CVEs are still pending.
I wanted to share the full write-up and PoC as an advisory! Until these issues are fixed, I'd recommend avoiding playing NTE on public networks.
I recently found two zero-day vulnerabilities in Neverness to Everness that can be chained for full account takeover.
NTE transmits authentication data in plaintext, which can be intercepted and modified by an attacker on the same network as the victim. Additionally, this data lacks replay protection, meaning captured authentication data can be reused indefinitely.
By chaining these together, an attacker can capture another player's authentication data and use it to log in and play NTE as a compromised player.
These vulnerabilities were responsibly disclosed to Perfect World / Hotta Studio. However, both remain unpatched after over 170 days of disclosure, and CVEs are still pending.
I wanted to share the full write-up and PoC as an advisory! Until these issues are fixed, I'd recommend avoiding playing NTE on public networks.