CVE-2018-4052

An exploitable local information leak vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can pass a PID and receive information running on it that would usually only be accessible to the root user...

CVE-2018-4049

GOG Galaxy vulnerability CVE-2018-4049 affects the Games directory. By default the Games folder grants broad permissions, allowing any user to read/write/modify files. An attacker could overwrite executables in installed games (when a privileged installer is present) and execute code with elevate...

CVE-2018-4050

An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can globally adjust folder permissions leading to execution of arbitrary code with elevated privileges...

CVE-2018-4050

CVE-2018-4050 affects GOG Galaxy Games on macOS (version 1.2.47) via the privileged helper tool. The root cause is changeFolderPermissionsAtPath, which allows an attacker to globally modify folder permissions, enabling arbitrary code execution with elevated privileges. Talos and related advisorie...

GOG Galaxy Games directory insecure file permissions local privilege elevation vulnerability

Summary An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy’s “Games” directory. An attacker can overwrite executables of installed games to exploit this vulnerability and execute arbitrary code with elevated privileges. Tested Versions Gog...

GOG Galaxy Games privileged helper denial-of-service vulnerability

Summary An exploitable local denial-of-service vulnerability exists in the privileged helper tool of GOG Galaxy’s Games, version 1.2.47 for macOS. An attacker can send malicious data to the root-listening service, causing the application to terminate and become unavailable. Tested Versions Gog...

A week in security (March 18 – 24)

Last week on Malwarebytes Labs, we touched on the susceptibility of hospitals against phishing attacks, password reuse, the risk of interactive TV shows to side-channel attacks, and Facebook's new and out-of-character plan to promote privacy in the platform. Other cybersecurity news A study...

Mail.ru: Open Selenoid instance at 188.93.63.186 leads to LFR/SSRF.

Externally accessible Selenoid instance in Mail.Ru Games network was vulnerable to LFR and SSRF via URI injection...

Rockstar Games: Image injection /br/games/info may lead to phishing attacks or FB OAuth theft.

In this report, the researcher identified an attack chain that could result in an attacker stealing sensitive user tokens such as Oauth tokens via full URL inclusion in the Referer header. One step of this attack involved an image injection exploit on localized versions of the games/info section ...

Rockstar Games: DOM based XSS on /GTAOnline/tw/starterpack/

In this report the researcher identified a DOM-based XSS vulnerability impacting localized versions of the https://www.rockstargames.com/GTAOnline/ site in varying locations. This attack also took advantage of an Open Redirect vulnerability on another part of the site to demonstrate how an attack...

Rockstar Games: DOM based XSS on /GTAOnline/de/news/article via "returnUrl" parameter

In this report, the researcher identified a DOM-based cross-site scripting vulnerability affecting localized versions of the GTA Online screenshots site, e.g. https://www.rockstargames.com/GTAOnline/jp/screens/. We have pushed out an update fixing this vulnerability so that it is no longer...

Rockstar Games: image injection /screenshot-viewer/responsive/image (ANOTHER FIX BYPASS)

In this report, the researcher was able to identify an oversight in our input filtering put in place to fix previous findings in the screenshot-viewer utility on the main website. Thanks to this report, we were able to improve our solution to prevent bypasses such as this one...

Rockstar Games: Image injection on /screenshot-viewer/responsive/image ( FIX BYPASS)

In this report, the researcher identified an image injection issue in the screenshot-viewer utility on our website that could be combined with other vulnerabilities to result in sensitive token theft. We were able to quickly push out an update to resolve the image injection issue, thereby...

Valve: Malformed map detailed texture files in GoldSrc games lead to Remote Code Execution

A crafted map detailed texture file maps/detail.txt can be used to exploit a stack overflow vulnerability in hw.dll that can lead to remote code execution. Reproduction I used Counter-Strike for PoCs. Using a listen server - Place attached csassaultdetail.txt in cstrike/maps folder - Start the ga...

Rockstar Games: Dom based xss on https://www.rockstargames.com/ via `returnUrl` parameter

In this report, the researcher identified a DOM-Based Cross-Site Scripting vulnerability in the Videos section of the GTAOnline site that appeared to only be exploitable on non-English versions of the site, such as /br/. The root cause appeared to lay in the ReturnUrl parameter in the logout...

Valve: Malformed playlist.txt in GoldSrc games leads to Access Violation & arbitrary code execution

A crafted playlist.txt can be used to exploit a stack overflow vulnerability in GameUI.dll that can lead to arbitrary code execution. Reproduction Place attached playlist.txt in game directory valve, cstrike, etc.. The game will crash when it tries to play Splash track. Exploitability The file ca...

Cheat Engine - A Development Environment Focused On Modding

Cheat Engine is an open source tool designed to help you with modifying single player games running under window so you can make them harder or easier depending on your preferencee.g: Find that 100hp is too easy, try playing a game with a max of 1 HP, but also contains other usefull tools to help...

Vulnerability Spotlight: Multiple vulnerabilities in GOG Galaxy Games

Richard Johnson and Tyler Bohan of Cisco Talos discovered these vulnerabilities. Executive summary The GOG Galaxy video game launcher contains multiple vulnerabilities that could allow a malicious actor to carry out a variety of attacks. GOG Galaxy Games is a video game storefront that allows use...

Rockstar Games: Image Injection on /bully/anniversaryedition may lead to OAuth token theft.

In this report, the researcher identified an image injection issue on www.rockstargames.com/bully/anniversaryedition that could be combined with other vulnerabilities to result in sensitive token theft under certain conditions. We resolved the image injection issue, preventing this series of...

Rockstar Games: Image Injection on www.rockstargames.com/screenshot-viewer/responsive/image may allow facebook oauth token theft.

In this report, the researcher identified an image injection vulnerability in our screenshot-viewer utility on rockstargames.com. One of the input parameters utilized was not being properly filtered, and external URLs could be referenced, allowing off-site images to be called. This issue was...