Valve · Report #1018368
Add any depot to your app and access its contents without decryption key; via /apps/setcommonredists
Validstatus
highseverity
56upvotes
30 Jul 2024disclosed
Summary
A parameter-validation error on an endpoint used to configure redistributable depots could be forced to add external depots to an existing (attacker-owned) app.
.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.