Pawn Promotes to a Second King

CVE-2018-90017117 Also known as: #KingMe attack Published 2018-12-03 Partial embargo until 2019-04-01 Common Vulnerabilities and Exposures Reported by t0m7 of East Coast Hacking Organization Description An input validation error in the move parser allows remote privilege escalation. Background The popular internet chess site lichess.org allows for the import of PGN files, a standard text-based interchange format for giving the sequence of moves in a game. Moves look like “e4” (move a pawn to the e4 square) or “Qxd3” (queen captures on d3) or “Rcc8” (the rook on the C file moves to c8). When a pawn moves into the last or first rank, it usually promotes to queen, but may legally promote to a bishop, knight, or rook at the player's option. This preference is specified using the notation g8=B (or N for knight, R for rook, or Q for queen to optionally be explicit). lichess.org does not properly implement this syntax, and allows a move like g8=K, which is not legal chess. Impact The pawn is promoted to a king. This is a privilege escalation vulnerability, because the king has privileges that the pawn does not have, such as the privilege to be checkmated. Scope The issue is only confirmed during PGN import (e.g. in “analysis board”). In live games, it is possible to use keyboard entry of moves in PGN notation, but =K is ignored. It is possible that these moves are only rejected in the frontend and would be allowed by the underlying chess engine (if made directly through the API, for example). After a second king is intro- Screenshot. After 5. ... gxh1=K ?!, black promotes their g pawn to a second king.

A screenshot of a CVE vulnerability report describes an input-validation bug in lichess.org that lets a chess pawn promote to a king using the illegal notation g8=K. The accompanying chessboard shows Black with a second king, turning a technical privilege-escalation bug into a joke about the king gaining the privilege to be checkmated. It is shared as an absurd programming and chess reaction to an unexpected or hilariously broken feature.

• @gentoomemes / 2267 2023-02-05
• @right_wing_dev_squads / 7780 2023-10-08