Valve: code injection, steam chat client

The steam chat client allows oEmbed, apparently based on a whitelist. One of the whitelisted oEmbedis codepen. When a codepen is created, it can be sent as a link to another steam user, and the code inside the codepen will execute within the privileged Steam Chat context. You can send these codep...

Valve: unlock self-lock by brute force

Due to a missing protection on the self account unlock feature, self unlock codes could be bruteforced - leading to unrestricted access to the account. The endpoint issue has been corrected...

Valve: XSS in steam react chat client

The Steam chat client both sends and receives bbcode format chat messages. These map to HTML elements, and notably the url bbcode tag is supported for arbitrary URLs. React has strong XSS mitigations but does not mitigate javascript: URI based XSS. This is rather difficult to exploit as the clien...

Valve: [help.steampowered.com] Account takeover bruteforcing SteamGuard

Due to a missing protection on a support endpoint, email verification codes could be bruteforced - leading to possible account takeover. The endpoint issue has been corrected...

Valve: XSS @ store.steampowered.com via agecheck path name

Hi, I found a Cross-Site Scripting XSS in store.steampowered.com because the path after /agecheck/ is not sanitized as it should. https://store.steampowered.com/agecheck/appmhuh2', sessionid: gsessionID, ageDay: '', ageMonth: '', ageYear: '' .done function response %20 ;alertXSS-by-TvM;function...

Valve: [Half-Life 1] Malformed map name leads to memory corruption and code execution

A stack overflow takes place when map names with malformed names are listed which can be used to execute arbitrary code. I made a Proof of Concept that executes gnome-calculator on Linux. This was tested on Half Life 2018-08-29 on Linux, Ubuntu 18.04. To reproduce: - Extract the attached zip-file...

Valve: Malformed .BMP file in Counter-Strike 1.6 may cause shellcode injection

With the vulnerability of the GoldSource Engine, the server is able to perform remote code execution on the client, overwriting the stack when reading the BMP file. The problem is in the LoadBMP8 function, which is executed when the player connects to the server, by loading the...

Valve: Getting all the CD keys of any game

Using the /partnercdkeys/assignkeys/ endpoint on partner.steamgames.com with specific parameters, an authenticated user could download previously-generated CD keys for a game which they would not normally have access. Audit logs were not bypassed using this method, and an investigation of those...

Valve: Reflected XSS on help.steampowered.com

URL: https://help.steampowered.com/en/wizard/HelpWithGameIssue/?appid=704740&issueid=125&option=%3Ch1%3Eunfiltered It puts option option into a translation token HelpGameMissingItemsTitleuser controlled string here And if there's no such translation token, it just prints out the entire user input...

Steam Bans Developer After Outcry Over Cryptomining, Scam Items

The popular Steam online gaming platform has pulled a simple, 2D game from its library, after it was found to be consuming an unusual amount of processing power on gamers’ machines. Steam owner Valve booted the game, “Abstractism,” after players lodged complaints about the game chewing up process...

Valve: CSRF | Ban or unban users in broadcast's chat

Steps to reproduce Start broadcast Attacker needs to craft special HTML page Get broadcast's steam idit contains in URL: https://steamcommunity.com/broadcast/watch/STEAM ID/ If attacker wants to unban somebody, he needs to create HTML page like this: document.getElementById"csrf-form".submit Unba...

Valve: Stored XSS in the guide's GameplayVersion (www.dota2.com)

Hi, team! The beginning of this issue looks like my previous report 369043, but this one will be much more interesting : So let's go! Steps to reproduce: 1 Open dota2 client and create new simple guide with XSS in the name. F318796 2 Publish this guide on steam. F318797 3 Now go to the Fiddler ap...

A week in security (May 28 – June 3)

Last week on Labs, we talked about the significance of SEO poisoning in the world of search marketing, blackmail attempts against financial institutions in Canada, voice command flaws in smart assistants, survey and potential phishing scams on Instagram, and the latest changes in Office 365. We...

Valve: Deleting other people's comments on ModeratorMessages

Due to a missing permissions check, anyone could delete a comment on a community moderator message knowing the unique comment GID and the SteamID of the message receiver. The endpoint has been corrected to verify the correct permissions. You were able to delete others people's comments on moderat...

Valve: Suspended users can bypass UGC upload ban

Community-banned users could potentially upload UGC, though not associated with specific Steam games...

Valve: Unfiltered input allows for XSS in "Playtime Item Grants" fields

Enter "test in any of the 3 fields, save it and reload the page. Impact Stored XSS, could possibly break some internal features too as the stored value is not an integer. The hacker selected the Cross-site Scripting XSS - Stored weakness. This vulnerability type requires contextual information fr...

Valve: resetreportedcount & updatetags doesn't verify appid param

This requires an account that has admin permissions on any community hub & Fiddler not 100% required, but I'll use it for the demonstration. resetreportedcount: Step 1: Go to any UGC in the hub you have admin access on, open Fiddler if you haven't yet, click Clear Reports and click OK on the...

Valve: Malformed .BSP Access Violation in CS:GO can lead to Remote Code Execution

A malformed .BSP can trigger an Access Violation on CS:GO that can lead to arbitrary code execution on a remote computer. I have attached a copy of the malformed .BSP which reliably triggers an Access Violation on CS:GO. Impact An attacker hosting a malicious server could compromise a remote clie...

Valve: GetReports works for hubs you don't have access to

Admin permissions on a game hub could be leveraged to view UGC reports on unrelated games. If an account had admin permissions on a game hub, he'd be able to view other game hubs UGC reports by simply making the appid parameter the appid of the game hub he has admin permissions on...

Valve: ImageMagick GIF coder vulnerability leading to memory disclosure

Due to CVE-2017-15277, portions of server memory on some steamcommunity web servers could be leaked via image updates. An attacker would not be able to control what memory would be returned, but system information could be obtained. I was able to arbitrarily disclose server memory on...