Summary

Summary, submitted by ████████ requires no additions by us and fully expresses impact and reasons behind the vulnerability.

Summary

By change the value of the cookie avatar, a hacker could not only get information of the support agent IP address, but also disconnect all the supports without interaction.

Vulnerability

The cookie avatar should have the value of a link to the user's steam avatar. A normal cookie is like that: https://steamcdn-a.akamaihd.net/steamcommunity/public/images/avatars/ae/ae6680902f4fe18e692ba9ea250bd694b34ad417_medium.jpg

But in the server, there is a verification like that (pseudocode):

bool valid_url = false;
if(cookies["avatar"].contains("https://steamcdn-a.akamaihd.net/steamcommunity/")){
    valid_url = true;
}else{
    valid_url = false;
}
```
Now start a chat with a support by sending a message.

Ok, so what if we insert the url, but after the hacker server?

### Privacy Violation (IP Address exposed)
`[hacker_server]/?https://steamcdn-a.akamaihd.net/steamcommunity/`
The server accept it and, when the support receive a message from the hacker, the support browser will try to load the url of the hacker's avatar and send a request to the hacker server. Now the hacker got his IP address.

### DOS (Forced log out)
`https://cs.money/logout?https://steamcdn-a.akamaihd.net/steamcommunity/`
now think. What if instead of the hacker server, we insert the URL of the logout in cs.money?
Bingo!
The support browser will make a request to the logout URL and it will disconnect him.

### Ending

One thing that I noticed is that not only the current support agent that we are talking, but all the online supports will try to load my avatar cookie.

Ok, now think in the first vulnerability, that is the `Privacy Violation`. The impact is that a hacker could get privacy information of the support and use this for phishing.

What about the second one? I think I don't even need to say the impact, but anyway: 
The impact is that a hacker could set the support function of the website offline: without supports agents there is no support :)
How much days would take to the devs know that this is a security problem, find it and fix it?

I am glad I can help.
#### If would like to contact me, don't hesitate to send a message to ████████#3684 (message, not friend request XD)