Valve · Report #577584
ISteamAssets gives partners control over unrelated community market transactions
Validstatus
highseverity
109upvotes
23 May 2019disclosed
Summary
ISteamAssets APIs would check that the key parameter used was a partner key with access to the appid specified, but then would ignore the passed in appid and would operate on app 753 regardless. This allowed anyone with a partner key to make changes to Steam economy items, like trading cards, and also could be used to reverse wallet fund spending on the Steam Community Market.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.