External clients can modify their hosts file to alias an IP address to chromasdk.io in order to access a remote Chroma Server. The server also does a hostname check to make sure that it is being accessed as instead of an IP address. The Chroma Server listens binds on all network interfaces and listens on port 54236. This issue is still present in the latest version which is 3.12.17. It chains several issues to enable me to remotely execute a file on the user’s system. This writeup is about a remote file execution vulnerability I found on the Razer Chroma SDK Server that comes with Razer Synapse.
