CDPR Warns Cyberpunk 2077 Gamers To Avoid Mods Due To Serious Security Exploit
When it comes to using the internet in any way, a general rule of thumb is that you should never download software from a source that you do not trust. Yesterday, CD Projekt Red
Support sent out a tweet to dissuade people from downloading mods for Cyberpunk 2077
because a vulnerability
was found the modding system's implementation.
CD Projekt Red’s tweet explained the issue occurs when malicious mods are downloaded and modify things that they should not change. The tweet then explains that this vulnerability will be fixed “ASAP,” but it is quite dangerous to players who have already ventured out to install mods.
If you plan to use @CyberpunkGame mods/custom saves on PC, use caution. We've been made aware of a vulnerability in external DLL files the game uses which can be used to execute code on PCs. Issue will be fixed ASAP. For now, please refrain from using files from unknown sources.
— CD PROJEKT RED CS (@CDPRED_Support) February 2, 2021
For a deeper explanation of the issue, the tweet further states that Cyberpunk 2077 would use external dynamic linked library (DLL) files when running the game. Andrew Kramer, a Dakota State University professor of computer science, speculates that this is case of DLL hijacking whereby a mod could include a malicious DLL that could be executed by Cyberpunk 2077. Ultimately, this issue likely falls under the purview of common weakness enumeration (CWE) 427, which explains that “The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.”
No matter the specifics, this issue poses an undue security
risk to Cyberpunk 2077 players who want to mod their game. For the time being, it is best to avoid mods from Cyberpunk 2077 altogether until CD Projekt Red and independent researchers can verify that all the kinks are worked out. Hopefully, no more issues will crop up, though, but keep an eye on HotHardware
for updates if they do.