HexBrain

Valve · Report #291750

Link filter protection bypass

Validstatus
mediumseverity
55upvotes
9 May 2018disclosed

How it was found

Description

Hi, there is a protection bypass in the linkfilter function. By using the character 。 (%E3%80%82 url encoded) instead of a normal dot in urls, it is possible to bypass the blocking.

PoC

Normal request : https://steamcommunity.com/linkfilter/?url=pornhub.com

{F240919}

Bypass : https://steamcommunity.com/linkfilter/?url=pornhub%E3%80%82com

{F240920}

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original