Summary

The web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent.

Specifically, this flaw could be exploited to abuse features from the Troubleshooting page. An attacker could trick the user into clicking a hidden "Unpair All" button, resulting in the removal of all clients associated with the Sunshine instance. This could lead to service disruption, loss of remote access capabilities, and require reconfiguration of the affected clients. This could also be exploited to trick a user into restarting the Sunshine instance, or changing the configuration of the Sunshine instance from the "Configuration" tab.

Details

The application uses Basic Authentication, which is inherently vulnerable to Clickjacking attacks in Chromium-based browsers when combined with the lack of proper UI framing protections.

Because the Sunshine UI can be embedded within a malicious website using an invisible iframe, an attacker could trick an authenticated user into clicking hidden interface elements, such as "Unpair" buttons or configuration options. This could result in unauthorized actions being performed on behalf of the user like unpairing trusted clients from the Sunshine instance, leading to loss of access and potential disruption of service.

To mitigate this issue, the application should implement defenses such as the X-Frame-Options or Content-Security-Policy: frame-ancestors headers to prevent the UI from being embedded in third-party pages.

Impact

An attacker can exploit the lack of Clickjacking protections in the Sunshine web UI to perform actions as an authenticated user, such as unpairing the clients, changing the configuration or restarting the Sunshine instance. The vulnerability can be exploited remotely over the internet without the Sunshine instance being directly exposed.

Fix

The bug was patched by 2f27a57.