While investigating the pakset HTTP→HTTPS redirect problem, I found a separate security issue in the Windows HTTPS download path.
A remotely supplied URL could reach the Windows command shell as part of the command text. Under specific conditions, this could allow command execution with the same permissions as the user running Simutrans.
I was able to reproduce the issue in a controlled environment.
There is no evidence that this has been exploited in the wild.
The issue is now fixed in SVN r12253.
The Windows downloader no longer places the remote URL in shell command text; the URL is passed to the downloader as data instead.
This also allows normal percent-encoded HTTPS URLs to work again without relying on a restrictive character blacklist.
Status: FIXED — r12253
Commit:
SEC: remove shell parsing from Windows pakset downloads