Overview
The world of cybersecurity is an ever-changing landscape, where new vulnerabilities are frequently discovered. One such vulnerability has been found in Sunshine, a popular self-hosted game stream host for Moonlight. This vulnerability, identified as CVE-2025-53095, is a serious threat to the safety and security of Sunshine users and their systems.
Sunshine prior to version 2025.628.4510 is susceptible to Cross-Site Request Forgery (CSRF) attacks, a type of malicious exploit that manipulates authenticated users into executing unintended actions. This vulnerability is particularly dangerous as it can lead to potential system compromise or data leakage, making it a critical issue that needs to be addressed immediately.
Vulnerability Summary
CVE ID: CVE-2025-53095
Severity: Critical, CVSS Score: 9.6
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Sunshine | Prior to version 2025.628.4510
How the Exploit Works
The CSRF vulnerability in Sunshine allows an attacker to craft a malicious web page. When an authenticated user visits this web page, it can trigger unintended actions within the Sunshine application on behalf of that user. Specifically, the application does OS command execution by design. This issue can be exploited to abuse the “Command Preparations” feature, enabling an attacker to inject arbitrary commands that will be executed with Administrator privileges when an application is launched.
Conceptual Example Code
The following is a conceptual example of how the vulnerability might be exploited. Note that this is a simplified scenario used for illustrative purposes and does not contain actual malicious code.
POST /startgame HTTP/1.1
Host: sunshine.example.com
Content-Type: application/json
Cookie: authenticated_user_cookie
{
"commandPreparations": "rm -rf /"
}In this example, an attacker could create a web page that, when visited by an authenticated Sunshine user, sends a POST request to the Sunshine server. The `commandPreparations` attribute in the JSON payload is set to a destructive command (`rm -rf /`), which, if executed, would delete all files in the system.