CVE-2024-39840
HIGHFactorio < 1.1.101 - Remote Code Execution via Lua Bytecode in Custom Map
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-39840. PoCs published by writegsqword.
AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2024-39840, leveraging memory corruption in Lua to achieve arbitrary read/write primitives and ultimately execute shell commands. The exploit uses double-to-integer conversion and fake object manipulation to bypass memory protections.
Description
Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom map that leverages the ability of certain Lua base module functions to execute bytecode and generate fake objects.
Exploits (1)
This repository contains a functional exploit PoC for CVE-2024-39840, leveraging memory corruption in Lua to achieve arbitrary read/write primitives and ultimately execute shell commands. The exploit uses double-to-integer conversion and fake object manipulation to bypass memory protections.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H