Valve · Report #652649
WG call injection in /economy/contextcommand
Validstatus
criticalseverity
47upvotes
30 Jul 2024disclosed
Summary
Context-specific commands to a web-facing gateway had insufficient parameter validation. Some economy queries could be run outside the actual requesters' capability by confusing the type system. Some bypasses for initial fixes were also provided.
Insufficient validation of parameters allowed making arbitrary calls to an internal data service.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.