Valve · Report #926169
Shell command injection in https://partner.steamgames.com/bundles/savestore/ via overwriting asset_path_identifier
Validstatus
criticalseverity
47upvotes
30 Jul 2024disclosed
Summary
Insufficient validation of parameters allowed injecting shell metacharacters into values used to construct a Bash command.
.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.