[FiveM] Players can be launched into the air via attached parachute object

[Levin6053]

What happened?

Cheaters are able to spawn a parachute object (model hash 1336576410) and attach it to other players. The attached object forces affected players upward into the air. As a side effect, the abnormal vertical movement is flagged by the anticheat, resulting in some affected players being wrongly banned for behavior they did not cause.

Expected result

Players should not be able to attach arbitrary spawned objects to other players.

Reproduction steps

1. A cheater spawns the parachute object (1336576410).
2. The object is attached to a target player via an entity attachment.
3. The target player is forced into the air by the attached object.
4. The anticheat detects the abnormal movement/position and bans the (innocent) target player.

Importancy

Unknown

Area(s)

FiveM

Specific version(s)

FiveM b3570, 29391 windows

Additional information

Affected object model hash: 1336576410 (p_parachute1_mp_s)

[divocbn]

If players are actually being knocked into the air because of the attachment, you can try one of two approaches:

1. Call ONESYNC_ENABLE_REMOTE_ATTACHMENT_SANITIZATION by default on the client, and then temporarily disable it for specific use cases (such as carrying or holding flags)
2. setr game_sanitizePlayerAttachment 2, which completely disables object and vehicle attachments from remote players, though i dont think that will be a problem on your server

[andreztheboss]

Get FiveGuard and add an entity object mass protection filter; that will solve your problem :)