Hey everyone!
Last friday, a community member sent us a report on a critical security vulnerability in how Ravenfield loads maps. This was a serious vulnerability that allowed for RCE (remote code execution) when loading custom maps from the workshop or other sources.
The security patch (Saturday, September 19)
I saw the report on saturday morning and issued a patch to the game right away, completely removing the vulnerability but also partly breaking how maps are loaded (which we have since fixed). We take security very seriously and want to be as transparent as we can on this matter, so here's what we know about the vulnerability:
The vulnerability was reported by a Ravenfield community member on Friday, September 18th.
I received the report on the morning Saturday, September 19th and issued a patch the same day removing the vulnerability.
The vulnerability was only present when loading custom made maps in rfl or rfld format, content mods such as rfcs are unaffected.
The vulnerability is within Ravenfield's code, and is not present in other Unity games.
As far as we know, the vulnerability has been present in the game since the introduction of modded maps.
We have never received any reports or indication that this vulnerability has ever been exploited, so to the best of our knowledge the vulnerability has not been known to anyone before it was reported to us by the Ravenfield community member.
Today's gameplay patch (Friday, September 25)
Today, I published another patch restoring some of the game functionality related to maps that was broken by saturday's security patch. When restoring the functionality, I spent some extra time rewriting the cover point placement system and navmesh node penalty/tagging system. Here's the change log:
Fixed an issue where map navmesh/cover point analysis data would stay loaded in RAM while playing a match. This seems to have been causing random crashes for some players where the game would seemingly randomly run out of memory and the game would crash.
Completely overhauled cover point placement and navmesh node tagging systems. These two systems are now several magnitudes faster (usually generating everything in under a second even on huge, detailed maps)
Cover point placement and navmesh node tagging is now automatically run whenever you start a map (they are super fast now anyway), allowing us to place better cover points, and making the bots use better paths when traversing the map!
Legacy Branches
After discovering this vulnerability, we removed all legacy branches of the game for the time being as they have not yet been patched. We may spend some time back-porting the security patch to these versions, however that could be fairly time-consuming. At the moment we have our hands full developing conquest mode, which we will be showing off soon. For the time being, I'd like to focus all our dev-time on getting conquest mode ready, so it may be a while before we are able to spend any time back-porting this security patch and making legacy branches available again. Let me know your interest, and if there's a particular game version you'd like to see return!
I hope this clears things up, we'll be back shortly with more regular content updates! We want to extend a special thank you to the community member who reported this vulnerability, you know who you are :)
/Johan (SteelRaven7) and the Ravenfield team
