Info Website Control Panel Incident

Dear Royallers,


On Saturday 1st of June 2019 we were alerted to some inconsistencies concerning 3 player accounts having been banned improperly the day before.

After a thorough review of our logs we found evidence of a malicious user having found a way to exploit a series of security vulnerabilities within the website Control Panel, this resulted in the ability to:

• Ban and unban player accounts.
• Circumvent email verification for forgotten password requests.

At no point during this has account information been leaked, and game accounts with sensible PIN and PIC codes active were never at risk of being accessed. Forum accounts are not affected.

Upon discovering the vulnerability, we immediately patched the bug and updated the website. However, today, we once again saw malicious activity affecting one of our GM tools on the website that handles banning player accounts, though no further password resets have been made since the initial security patch.

Due to the severity of this and not wanting to take any chances, we have decided to completely remove all functionality from the control panel (with exception to logging in/out for donating) until we are ready to implement a brand new control panel system. The new control panel has already been in development for a while as it is part of our plan to revamp and modernise the website entirely, and so should be released soon. The new website is our next planned project to be released after the upcoming Anniversary update. Both the website and Anniversary update are currently being developed in tandem.

We are still in the process of reviewing and undoing the actions taken by this malicious user. However, we have logs related to everything done within the website, so are able to reverse any damage caused without a rollback. If you have found yourself unexpectedly banned or having trouble accessing your account, we would still advise that you should contact us for assistance, which you can do through one of the links below:

• https://royals.ms/forum/forums/ban-appeal.8/
• https://royals.ms/forum/threads/account-recovery.58313/

We are very sorry for any inconvenience caused to the affected users,

-The MapleRoyals Staff