Rockstar Games · Report #497655
Image Injection on www.rockstargames.com/screenshot-viewer/responsive/image may allow facebook oauth token theft.
Validstatus
mediumseverity
14upvotes
12 Jun 2020disclosed
Summary
In this report, the researcher identified an image injection vulnerability in our screenshot-viewer utility on rockstargames.com. One of the input parameters utilized was not being properly filtered, and external URLs could be referenced, allowing off-site images to be called. This issue was resolved with the researcher's help.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.