[Security] Broken authorization on setAnnouncement and servicesInfo commands

[coderabbitai]

Summary

Critical authorization bypass allowing any client to modify server state.

Affected Code

• server-services/start-services.js Lines 437-445 (setAnnouncement)
• server-services/start-services.js Lines 446-458 (servicesInfo)

Vulnerability

Both handlers check only if (msg.auth_key) without validating against a server-held secret. Any non-empty string passes.

Impact

• setAnnouncement: Any client can persistently modify the global game announcement in the database
• servicesInfo: Any client can inject fake cluster status data

Proof of Concept

{"cmd":"setAnnouncement","auth_key":"anything","announcement":"pwned"}
{"cmd":"servicesInfo","auth_key":"anything","thisServer":0,"gameInfo":{}}

Recommended Fix

Use timing-safe comparison against an environment/config secret.

References

• PR: New Blocks & Ported fancyMuzzle flash #43