GodotSteam: Server peer ID spoofing
A vulnerability in GodotSteam versions 4.17 through 4.23.2 allows any multiplayer peer to claim the server ID of 1, enabling unauthorized administrative command execution.
Triage facts
Revision 1- Applicability
- GodotSteam (4.17 through 4.23.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 21:08 UTC
- Source quality
- A1Likely
GodotSteam versions 4.17 through 4.23.2 contain a vulnerability where the library fails to validate the peer ID transmitted in initial network packets against the Steam-verified account identity. In Godot, the server is identified by peer ID 1. Because the library accepts the peer ID provided by the sender without cross-referencing it with the Steam authentication layer, any connected client can spoof their ID as 1 and gain the privileges reserved for the game server.
Impact
Successful exploitation allows a malicious client to impersonate the game server and issue administrative commands within the session.
Recommendation
- Update GodotSteam to a patched version beyond 4.23.2 as soon as one is made available by the maintainers.
- Implement server-side validation for all critical administrative actions to ensure that commands are only accepted when they originate from the host's actual SteamID, rather than relying solely on internal peer IDs.
- Perform code audits on game logic that relies on the peer ID value provided by the GodotSteam library for authorization.
Threat Hunt
Identify game sessions where multiple clients claim the server peer ID (ID 1) or unexpected administrative commands are received from non-server SteamIDs.
Data: Application-level game server logs, Custom network packet telemetry
Mitigations
Implement secondary validation of administrative commands based on SteamID rather than peer ID.
GodotSteam peer ID spoofing