Valve · Report #815547
Unauthorized updates to extended_info properties in /store/ajaxpackagesave
Validstatus
highseverity
23upvotes
9 Sept 2020disclosed
Summary
Due to incorrectly-implemented access control, partners were able to set the "extended_info" value on their own packages. This in turn enabled other security-impacting issues such as the ability to create externally-grantable and other special package types.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.