PhantomPtr
5954c8adde
See CHANGELOG.md (6.0.0). Full history of the work: tag ftx2-last and branch history archived in ps5upload-docs.
1.9 KiB
Security Policy
Supported versions
ps5upload ships from main as a rolling release; only the latest
release receives fixes. Please reproduce any issue on the most recent
release before
reporting.
Reporting a vulnerability
Please do not open a public issue for security vulnerabilities.
Report privately via GitHub's Report a vulnerability button (Security tab → Report a vulnerability). This opens a private advisory only you and the maintainer can see.
If you can't use that, reach the maintainer on Discord and ask for a private channel — don't post details publicly.
Please include:
- what the issue is and its impact,
- steps to reproduce (or a proof of concept),
- affected version / platform.
You'll get an acknowledgement as soon as practical. This is a free, volunteer-maintained project, so timelines are best-effort — but security reports are taken seriously and prioritized.
Scope
ps5upload talks to a jailbroken PS5 over a LAN. The AVA1 protocol
(port 9120) uses the Noise XX handshake and encrypts and authenticates
every byte; the console only accepts devices that were paired by comparing
a six-digit code, or the engine that launched it. Weaknesses in pairing,
the handshake, or AVA1's message parsers are squarely in scope. The
local engine binds loopback (127.0.0.1:19113) and rejects non-loopback
callers except the PS5-facing /pkg-host/ route. Reports most in scope:
- the desktop/Android client and the local engine service,
- the PS5 payload's network-facing handlers,
- the release/build pipeline and bundled dependencies.
Out of scope: attacks that require already-untrusted access to your LAN or physical access to an unlocked machine, and the security of the third-party jailbreak/loader the payload depends on.